Question: Pre-processing text for Amazon Comprehend classification

"I want to use Amazon comprehend for sentiment analysis. Regarding both the case when using the built-in model or training a custom model of my own is it necessary, or favorable in any way, for me to first do some pre-processing on the text before analyzing it? Such as removing stop words, performing lemmatization etc.Thanks!FollowComment"

Answer: "0Pre-processing the text for Amazon Comprehend is definitely not required, I have run Comprehend jobs without any pre-processing and got good results.  Whether it is favourable is probably dependent on the specific dataset. I've never tried it and I'd be surprised if the results differed significantly, but the best way is probably to try it yourself with your dataset and compare the results.Cheers,HeikoCommentShareHeikoanswered 7 months ago"


Question: EFS mount on ec2 not tolerant of zone failure

"Hi,I use a efs mount on my ec2s that are part of a auto scaling group. Whilst doing some house keeping I spotted that the efs was spread across three subnets that I didn't intend.I used the manage network option within the EFS console and removed a zone and then added it back with the correct subnet. This caused the mount on my ec2's to become unresponsive. I simple reboot resolved the issue.This got me thinking about what would happen with a zone failure so I did some tests. It appears that if you remove a zone from an EFS, if the ec2 mount isn't using that zone then everything is ok, however, if that zone is currently being used, then the ec2 mount doesn't failover to another zone and the mount becomes un-responsive.Is there any way to mitigate a zone failure on a efs mount or is this a single point of failure in a system using efs mounts?My fstab entry options are;nfs4 nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport,_netdev 0 0Thanks for any advice.FollowCommentBrettski-AWS EXPERT7 months agoWhat DNS hostname is your mount using?SharePaddy 7 months agoThe dns name is fs-0d2<obfuscated>5b.efs.eu-west-1.amazonaws.comShare"

Answer: "0Hi , perhaps this document would provide more clarity - https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html#how-it-works-conceptual , especially the part "We recommend that you access the file system from a mount target within the same Availability Zone for performance and cost reasons." . In addition, cross-AZ mounts ( EC2 in one AZ and mount target in another ) would also reduce availability . If any one of those AZs go down, your application availability  will be impacted. That's the reason EC2 and mount target should be in same AZ ( static) and any changes in the network settings of the mount target  would make the mount unresponsive on EC2. For any zonal failures, EC2 instances and Mount Targets on another AZ should be able to pick up the additional load.CommentSharejmbawsanswered 7 months ago0The challenge here is the interaction between DNS names, IP addresses and applications - in this case, the application is the NFS client.The intention behind using a DNS name rather than an IP address for a resource (and this is regardless of application) is that the DNS lookup can return multiple IP addresses. The application can then choose one (normally at random, but it might have some mechanism for using something "closer" to itself - or maybe on the local network; most of the time this doesn't happen though) and that IP address is what it connects to. If the IP address doesn't respond then it can choose another from the list that was returned in the first place.Note that this choice and the retries (in the event of a failure) might be done at an operating system level rather than within the application. But either way, it works pretty much the same.But what happens when the application connects to an IP that works; but later on that IP stops working? The application has to use one of the other IP addresses; it might have them cached or it might do a DNS lookup again. That's not really the issue - the challenge is, how long does it take for the application to figure out that the IP address it is communicating with is not responding? And in that case, does it do another DNS lookup to try another IP address; or does it just retry the existing IP address forever? At what point does it give up?In this case, the NFS client might eventually figure out that the original IP address isn't responding and try another. But it also might not. From this distance, it's not possible to say because I don't know what NFS client is being used; and even if I did it's more a question for the developers/designers of that client. The timeout might even be adjustable - again, a question for the developers of the client.You might find that rather than a reboot it would be possible to reset just the NFS client by sending a signal/interrupt of some sort. But again, you'd need to reliably detect that the endpoint wasn't responding.CommentShareEXPERTBrettski-AWSanswered 7 months ago0Thanks to both of you for taking the time to give me your thoughts.This efs is shared across ec2's in an ASG. The instances have Apache2 running so I think I'll move the health.html file for the health check form the ami and put it on the efs, This should mitigate against a ec2 that isn't fully functional residing in the ASG.CommentSharePaddyanswered 7 months ago"


Question: Disabling password expiration

"Hi everyone,I have different WorkSpaces set up on different locations but the ones I have in a particular one seem to have a password expiration set up for users so I need to reset it up for them every month.Does anyone know how can it be disabled? Is this tied to the directory?Thanks,LauraFollowComment"

Answer: "1The password comes from Active Directory. On the user object in Active Directory Users and Computers, click the checkbox to not let the password expire.CommentShareEXPERTStevieStetsanswered a year agoAWS-User-8012251 a year agoHi Stevie, thank you for your reply. Where is the user object? This is what I see: https://i.imgur.com/v1SgZn4.pngThanks!ShareAWS-User-8012251 10 months agoExcuse my ignorance, but is this something I can change from here? https://imgur.com/6nnElfi.pngThanks!Share0Hi,From the notes, I understand that you want to disable the password expiration. Here are steps to follow to achieve that:[1] Launch an EC2 Windows Instance.[2] Domain join it to your Directory (This will enable you to login in as an Administrator)[3] Connect to your instance.[4] You can now change/reset your password policies.I have included a link [1] to guide on Supported Policy Settings available to achieve the above mentioned issue.Resources:-[1] https://docs.aws.amazon.com/directoryservice/latest/admin-guide/supportedpolicysettings.htmlCommentShareAsisiphoanswered a year agoAndrew_W EXPERTa year agoyou can load the AD tools into a WorkSpace used by an admin - no need to start an EC2 instance.Share0Manage password policies for AWS Managed Microsoft ADhttps://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_password_policies.htmlCommentShareGuang Liuanswered 10 months agoAWS-User-8012251 10 months agoExcuse my ignorance, but is this something I can change from here? https://imgur.com/6nnElfi.pngThanks!Share"


Question: Wind vectors badly formatted netCDF file

MilesSowden asked: Wind vector netCDF product can be manipulated using CDO tools but can't be displayed with ncview. Seems to have corrupt grid definitions from open-data-docs/docs/noaa/noaa-himawari/2020July08_NOAA_Himawari.pdfFollowComment


Question: AWS Backup of RDS managed Oracle or MS-SQL database

Can AWS Backup be used to backup an Amazon RDS managed Oracle or MS-SQL database?FollowComment

Answer: "0Hello,Yes AWS Backup can be used to back up RDS databases including Microsoft SQL Server and Oracle.How to: https://aws.amazon.com/getting-started/hands-on/amazon-rds-backup-restore-using-aws-backup/Documentation: https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.htmlCommentShareEXPERTChris_Ganswered a year ago"


Question: vfio-pci and non metal G4dn EC2 instances

"Hello,I'd like to know if it's possible to PCI passthrough my G4dn non metal's GPU through vfio-pci driver or if it's something only possible when using a metal EC2 instance type.Thanks in advance.Regards,TarikFollowCommentMichael_F EXPERTa year agoAre you not seeing it already on the PCI bus? I see it when I run lspci on a g4dn.xlarge instance:# lspci | grep NVIDIA00:1e.0 3D controller: NVIDIA Corporation TU104GL [Tesla T4] (rev a1)ShareTarik a year agoHello Michael,I'm seeing in it on the PCI bus But what I'm trying to do is connect it to the vfio-pci driver (https://www.kernel.org/doc/Documentation/vfio.txt).Here's how it's done: https://github.com/NVIDIA/kubevirt-gpu-device-plugin#preparing-a-gpu-to-be-used-in-pass-through-modeHower this does not seems to work on my G4dn instance and I was wondering if it's because I'm using a non metal EC2 instance.Share"

Answer: 0Hi TarikYou need virtualization to do PCIe passthru and on AWS that means a bare metal server.CommentSharesbates-nvmeanswered 9 months ago


Question: How to get missed calls data/phone numbers specifically in amazon connect? OR push this data to google Sheets or S3 if possible?

I am looking for a way out as how can i get the data/phone numbers of calls missed by agents so can i make some evaluation.Is there any way? like we are getting it in historical metrics as a percentage.FollowComment

Answer: "1Hi there Abdul!  You can find this information in Contact Trace Records.  If you enable data streaming in your instance settings, you can use Kinesis Data Firehose to store CTR in S3.Once stored in S3, you can then use Amazon Athena and Quicksight to visualize the data, or AWS Lambda to process the data.Here's a couple of reference links that you may find helpful:https://docs.aws.amazon.com/connect/latest/adminguide/data-streaming.htmlhttps://docs.aws.amazon.com/connect/latest/adminguide/ctr-data-model.htmlhttps://aws.amazon.com/blogs/contact-center/analyze-amazon-connect-contact-trace-record-with-amazon-athena-and-amazon-quicksight-part-1/CommentSharegthomasanswered 10 months agoEXPERTAWS-samfredreviewed 2 months ago0I think this blog post will get you about 80% of the way there. Ultimately, you just need to figure out where you want to put the records extracted by the Lambda. https://aws.amazon.com/blogs/contact-center/recovering-abandoned-calls-with-amazon-connect/davidCommentSharedmaciasanswered 10 months ago"


Question: High Quality Shadows

"I am trying to enable High Quality Shadows on a character and I can't seem to get the process down. I've read through:High Quality ShadowsScript Canvas ShadowsShadow Scripting Nodesand still I'm missing something. I have the High Quality Shadow component on my character.and a simple script canvas that should be enabling the high quality shadows based on an input.The only thing I can think of is I don't have a Shadow Map; but, I wouldn't know where to place it if I did. I've checked through the different material types and haven't found a Shadow Map checkbox or map input.Follow"

Answer: "0Accepted Answer@REDACTEDUSERI can confirm that the high quality shadows are only intended to work with the sun. This component gives an entity its own shadow map that will have a higher resolution than the global shadow map. Use it sparingly because it will cause a performance and memory impact.You can use this component without using Script Canvas. Script Canvas would be used to dynamically enable or disable this feature. More information about this can be found on this page, Shadow Nodes.SharerePost-User-1190460answered 6 years ago0From what you posted it looks like your shadow should be always enabled independently from the input.Your script doesn't toggle it, but just enable something on pressing that is just enabled from the component.So leave away the script for a moment and try to toggle your shadow component on and off and see if you get any difference(in other cases you encountered a bug).You don't need any special slot as the shadow map is dynamically generated.Also check your bounding box as the shadow is optimized around it.SharerePost-User-7621041answered 6 years ago0Sorry for the issues. I've created a ticket to get someone to help you work through this.SharerePost-User-8353690answered 6 years ago0@REDACTEDUSERThanks for your response. I tried toggling it and didn't see a difference. The documentation is what prompted me to create the script for the shadows as it said I needed to enable the shadows through Script Canvas.Changing Bounding Box Scale also didn't seem to do anything.SharerePost-User-5046793answered 6 years ago0Hello @REDACTEDUSERI'm a technical artist on Lumberyard and I am here to help you! I haven't used the High Quality Shadow Component yet. So, I am going to look into its setup and use and then will let you know what I discover. Stay tuned for an update!CiaoSharerePost-User-1190460answered 6 years ago0It works flawlessly on jack character just putting the component on it without any scripting.SharerePost-User-7621041answered 6 years ago0Hey @REDACTEDUSERThrough a bit more testing, it seems like the High Quality Shadows only work with the light emitted from the sun. Is that correct? My character was indoors when the shadows weren't working and once she was outside they started working.SharerePost-User-5046793answered 6 years ago0it is intended for use with the sun as discrete lights can be manually set up to focus their shadow resolution on characters during cinematics.SharerePost-User-7621041answered 6 years ago0@REDACTEDUSERI didn't see anything in our documentation about whether or not High Quality Shadows only work with the sun. I have reached out to the engineering team to find out more details!SharerePost-User-1190460answered 6 years ago"


Question: Week number with If else

"I am new to create calculated fields with the Quicksight. I have some dataset with the resolved tickets information which needs to be shown with the tag and with the week of the year. Is it possible to show through table ?Example ) I have 10,000 resolved tickets for each week which needs to show through week numbers only and with the selected tag with the ticket. I have access to the dataset but unable show the same through Week numbersFollowComment"

Answer: "0I'm not a QuickSight expert but a search turned up this which may help:Click the dropdown for your date field, mouse over Format and select 'More formatting options'. On the left panel in the Custom dropdown type 'w'.CommentShareEXPERTBrettski-AWSanswered a year agoShiva a year agoThanks for your comment.I am able to extract for the visualization purpose with the drill down to Week and Month is there.When tried to use a table to show the weekly numbers of the tickets i am unable to do thatShareMLGuy a year agoCreate a calculated field that will use the w format from https://www.joda.org/joda-time/apidocs/org/joda/time/format/DateTimeFormat.html, using the formatDate function (https://docs.aws.amazon.com/quicksight/latest/user/formatDate-function.html)Share"


Question: Lexbot initial greeting

"I want to display a Lex response card when an end-user opens Amazon Connect Chat window on my website. Currently, an utterance (“Hello”,”Hi”, etc.) by the end-user successfully invokes the response card. What I want: have the chatbot invoke the response card without end-user input. I have tried various solutions such as configure a dummy intent (“autowelcomemessage”) and use a lambda to call it. But these attempts have not worked. Presently, I am using the default chat widget, not hosting a customizable web UI.FollowComment"

Answer: "0Accepted AnswerHello,This is Tom from AWS Support.The default chat widget does not support showing list picker without customer input.To have the chat bot invoke the response card without end-user input, you will need a customized Chat widget:https://github.com/amazon-connect/amazon-connect-chatjsThrough that chat widget, you can invoke Lambda function manually and show the response card when chat first initiated. After all, it is the Lambda function's response that defines what Lex bot will show for the chatFor more information, I would recommend taking a look at this AWS blog:https://aws.amazon.com/blogs/contact-center/easily-set-up-interactive-messages-for-your-amazon-connect-chatbot/I hope the information helps.CommentShareSUPPORT ENGINEERTom_Tanswered 6 months agorePost-User-1558193 6 months agoThanks for the answer!Share0You're going to need to create a custom UI and then send the hello based on some visitor action. For example, if they click the chat button you automatically send a "Our bot will be right with you." and then the bot starts. Or if the user scrolls down you then pop the chat window and push a message to it so it can reply. Ultimately, not possible out of the box.davidCommentSharedmaciasanswered 6 months agorePost-User-1558193 6 months agoThanks for confirming this! Much appreciated.Share"


Question: Using DMS CDC for Oracle to Postgres

"Hello All,I am trying to see the feasibility of using DMS CDC for Oracle to Postgres on going data updates. Created the task for CDC. It is reading changes from the Oracle 19c Source table. For some unknown reason(for myself), it is not applying the changes to Postgres 13 RDS database.Is there a specific setup i am missing? Please advice.Thanks in AdvanceFollowComment"

Answer: "1Can you confirm you have followed these steps to set-up the source Oracle database - https://docs.aws.amazon.com/dms/latest/sbs/chap-on-premoracle2aurora.steps.configureoracle.htmlCommentShareEXPERTIndranil Banerjee AWSanswered a year ago0Thank you for your response.Yes. I did all the settings as in the document. It was working fine for Oracle to Oracle RDS data replication.Now trying to do the same for Oracle to Postgres RDS.I am sure it is some privilege missing on the target instance. Not sure, what it is.CommentShareAWS-User-4620625answered a year agoIndranil Banerjee AWS EXPERTa year agoNot sure if this will help, but this document does have some troubleshooting tips - https://docs.amazonaws.cn/en_us/dms/latest/userguide/CHAP_Troubleshooting.html#CHAP_Troubleshooting.General.NothingMigratedShare0Hello,As DMS task worked fine with Oracle to Oracle RDS data replication, the difference between Postgres would come for tables names. Oracle treat all table name  in CAPITAL letter but postgres is the opposite, all in LOWERCASE.Most likely you would need to add transformation rule to convert all table and schema name to lower case.Hope that helps, if not, then pls. share the dms log for understanding it more.ThanksCommentShareJitenderanswered 2 months ago"


Question: Patching Manager

"I need to deploy a patching manager but I've a couple issues which is the patching manager can't see the instance that I create plus I checked the IAM, security group, and subnets and still not working, can someone assist please.Thank you,FollowComment"

Answer: "3My best guess is instance is wither running in a region not supported by Patch Manager or the patch baseline created in patch manager was configured to deploy to instances in regions other than where your instance is deployed.You can see in the screen shot below the available regions you can choose to configure a patch policy.CommentShareabemusaanswered 2 months ago0Hello,Patch manager is able to perform patching tasks on instances which have ssm-agent activated in them.To confirm if an instance is SSM managed, please navigate to Systems Manager -> Fleet ManagerIn Fleet Manager, you should be able to see all the instances which are SSM managed.If your instance is not visible in fleet manager, then please follow this linkI hope this helps.CommentShareSUPPORT ENGINEERVinay_Sanswered 2 months ago"


Question: NVMLError_FunctionNotFound: I was trying to deploy a PyTorch model in a ml.g4dn.xlarge instance

"I was trying to deploy a PyTorch model in a 'ml.g4dn.xlarge' instance for real-time inference.framework_version='1.13.1'py_version='py39'However, I kept getting pynvml.nvml.NVMLError_FunctionNotFound: Function Not Found in the log when deploying it.Is it issue related to Nvidia GPU driver version?FollowCommentshaoyong shen a month agoHi, Nyana, did you resolve this issue? I met the same one.Share"


Question: how to skip null value when mapping in aws glue etl job

"When I started an etl job and mapped one table to a s3 bucket and change some data type. I got two columns empty because these two columns included some null value, how can I skip the null value in the old table and keep loading the data to the new table (keep the null value null in the new table)?FollowComment"


Question: Why AWS SES Production Request Denied

"Hi,We read all of documentation from AWS about how to get out of a sandbox, answered for all of their questions, but still getting denied. Can you tell us the reason why? My case ID : 9587191641 .We hope you will help us to resolve this problemFollowComment"


Question: gRPC streaming through ALB using ECS

"I have a gRPC server running on an ECS cluster, and I've put an ALB in front of it (using protocolVersion gRPC). When trying to connect to the server, I'm able to run a method that uses a unary connection. However, once I try a bidirectional streaming endpoint, the server blocks on trying to receive the stream coming from the client. After the timeout it ends with a "Broken pipe" error. This applications runs without any problems on a docker locally, so it seems that I'm missing some network configuration.All components are in the same VPC, I have two security groups, one for the ALB allowing 443 traffic from everywhere and all outgoing traffic, the second security group is for the ECS cluster and allows all traffic from the ALB, and all outgoing traffic.I have tried to allow all traffic from the ECS cluster to the VPC as well, without any success.Does anyone have any idea why there is this difference between unary and bidirectional streaming and how to solve this?FollowCommentrePost-User-1382790 5 months agoI've narrowed it down. I can connect do a stream using grpcurl, however, when using our client (both client and server written in rust using tonic/hyper/rustls/...) it blocks. Obviously, our code works running on a local docker and connecting with our client. The issue seems to be caused by some combination of our libraries and the ALB -> ECS setup. Anyone encountered something similar?Share"


Question: 421 too many commands

"We mostly use our workmail for standard company mail but we do run a few tasks that send automated emails and we have started seeing "421 too many commands". Is this is because of a rate limit? If so, what is the send rate limit for sending with workmail via smtp?FollowComment"

Answer: "0Yes, this is because of a rate limit. The SMTP protocol is complementing the IMAP procotol because it's the only protocol that does not send email. We allow low rates of sending for normal email clients and automated systems will probably hit out rate limiting. Depending on your usecase you might be better off looking into using SES to send large amounts of email.CommentShareJohnAWSanswered 4 years ago"


Question: Instance reachability check failed

"I am a new AWS Snowball family user working on a Edge Compute Optimized Snowball. I have followed the steps in the tutorial video here (https://www.youtube.com/watch?v=GDDJgQCtPRg) without any issues. Now that my instances are set up however, I am unable to access them and they continue to fail the reachability check.Troubleshooting steps included the following:-Trying different Operating System images (currently Windows 10 and CentOS7)-Stopping and restarting the instances-Restarting the SnowballEdge-Changing instance types-Enabling/Disabling key pairs-Changing Image volume sizeBecause I am using AWS OpsHub to manage the SnowballEdge, it does not appear I am able to take console screenshots or pull logs in the same manner that is recommended for troubleshooting with AWS Console.Appreciate any insight into the matter.FollowComment"

Answer: "0How did you setup the IP for your instances? Did you use VNI or DNI? Also, do you have Static IP or DHCP IP assigned to the instances?Can you post snapshot of your network setup? Most of the time the issue is related to VNI setup and reachability.CommentShareAWS-NitsJeganathananswered 4 months ago0I was able to get the instances to work by importing raw images instead of OVA. VM Import documentation stated both were acceptable but only raw worked for me.CommentSharerePost-User-7184548answered 3 months ago"


Question: Build a turn-based game with Amazon DynamoDB and Amazon SNS - UK telephone number problem.

"Hi allI started doing the above lab and have came across an issue and I'm not sure if its me or this is a problem. Of this lab I'm on module 3 which is set up notifications, you need to copy a line of code, edit it to have your own country code and your own telephone number. This is the code -echo "export PHONE_NUMBER=+15555555555" >> env.sh && source env.shI won't include my telephone number but being based in the UK mine looks something like this -echo "export PHONE_NUMBER=+4407983655512" >> env.sh && source env.shI have also tried -echo "export PHONE_NUMBER=+447983655512" >> env.sh && source env.shNone of the above worked when you add the next line of code which is to send a message, the interface tells me "sent message successfully" but I haven't received anything. I'm thinking I may need to go back a few steps and change the region to one in the UK but I think that would be a stretch  otherwise it wouldn't be asking for the international code.Hope someone can helpThanksFollowCommentedeastwood a year agoI'm not familiar with the lab you're referring to or the scripts that it runs, but the first place I'd look would be the CloudWatch logs (see: https://docs.aws.amazon.com/sns/latest/dg/sms_stats_cloudwatch.html). This'll help determine whether the problem is with your configuration, the lab scripts, or SNS.Share"

Answer: "1It might be that your account is in the SMS sandbox for the region you're using, which means that you can only send messages to verified phone numbers.When I tried the code from the lab, I also got "Sent message successfully" and no SMS message when using a region where my account is in the SMS sandbox. Once I either used a region where the account has production access or verified my phone number in the region, I received the message successfully.https://docs.aws.amazon.com/sns/latest/dg/sns-sms-sandbox.htmlCommentShareEdanswered a year agorePost-User-7200015 8 months agoEd, Thank you so much for responding. I apologise I never saw this sooner!Share"


Question: On dynamic slices

"Hello!As far as I gather LY team seems to push dynamic slices as a way to create new entities at run-time. I came to this conclusion based on lack of any documentation whatsoever regarding creating a simple entity with some arbitrary components at run-time, and the existence of scripting solutions which implements spawners with dynamic slices. This post is about game entities at run0time, not about chuncked world management, where I believe dynamic slices are cat's meow.This begs the following:LY team please clarify whatever dynamic slices are indeed your vision of instancing new game entities at run time.Dynamic slices are IO storage baked objects. When you instantiate a dynamic slice, the system will inevitably hit the IO storage stack to load the slice, resolve the resource dependency graph, then load resources (meshes, textures, ... you got the idea). Once those are loaded, they seem reference counted, which is a good ideea. Note that this step can result in pretty heavy IO.Now assume you use dynamic slice mechanism to instantiate an arbitrary gameobject at run time, lets say an enemy AI. Its a pretty heavy object it has meshes, skins , skeleton , texture, animgraph of its own. This will cause pretty heavy IO. No problem , it can be solved, just be attentive where you spawn the object and because it is loaded asynchronously , the player wont notice.The player wont notice, except in a worst case scenario , it may cause a load of IO. Imagine I spawn such an object, the destroy it, only to spawn it again 100 ms later. This will cause asset reference count to drop to 0, resources freed, then, 100ms later, the IO stack is hit again to create a new instance. This will affect your IO budget. How much, is n a case by case basis. It will also cause effects on CPU memory pools, then PCIe bus to cache new data in GPU, trashing caches , eating bandwidth and forcing gpu / cpu synch . Last but not least, it has the potential to cause memory fragmentation on all the memory pools, both GPU and CPU. (worst case scenario we are taling here, short life spans, reference counts drop to 0, only to be recreated ms later.Also, the player WILL notice IO if you cannot hide it with level design. For example weapon projectiles , imagine a game where your weapon spawns demon projectiles with basic AI, mesh , animation, fx and all that instead of a hit scan . It will hit very heavily the IO stack, causing both player annoyance, and eating a good chunk of your IO budget.LY team, please clarify. If this is indeed the preferred way to create game objects at run time, then is there any way to load a template of a dynamic slice in memory, precache it, and just clone from it the required game objects , to totally avoid IO ? It would solve the issue with worst case scenario, because the template slice will hold references to the resources in question.LY team, please clarify, if dynamic slices is not to be used for objects with such problematic life cycles, which is the intended way to do it and document it properly in your entity component sytem documentation.Follow"

Answer: "0Hello, this is still relevant in 2019. Can we please get a clarification on the matter?SharerePost-User-1974261answered 4 years ago0Yeah the docs a little bit lacking about how to create entity with various components on runtime (on fly).But you still can ably construct entities with various components on fly.For some components the LY API still lacking (not all methods of components are public or Ebus are missed some functionality for dynamic creation), since devs are mainly focused on using of Slices or DynSlices.I think this wrong, since dynamic creation is more powerful than preconstructed with Slices.But you can do own asset manager (pool of preloaded assets)and tried to use it for own dyn entities.I think in this case you will got a less IO operations, since assets are already preloaded.Some time ago I made my own simple componet with dynamic initialization.you could take a look on this code here :MeshComposedComponent.h https://pastebin.com/QUqKr1jv MeshComposedComponent.cpp https://pastebin.com/JEqCb7WK The problem of this example is that each instance of this component loads assets, but I think this can be fixed if you write your own system componet that will be load pool of assets. From this new custom asset manager(pool) such kind dynamic components may just requst the reference to some needed Assest and use it for internal components.SharerePost-User-2514050answered 4 years ago0Dynamic slice docs are here: https://docs.aws.amazon.com/lumberyard/latest/userguide/dynamic-slices-what-is.htmlQuote: "Standard slice assets (.slice files) rely on the editor and cannot be instantiated at run time. However, Lumberyard provides a mechanism for designating any .slice asset that you've built as a dynamic slice."So yes, dynamic slices are there for you spawn slices dynamically at runtime. Dynamic slice shouldn't be hitting I/O once their assets have been loaded once before. The caching system behind the scenes should take care of that.Are you specifically seeing I/O being hit on each instantiation of the same dynamic slice over and over?In fact, if you are using Interest Manager from GridMate ( https://docs.aws.amazon.com/lumberyard/latest/userguide/network-interest-manager-large-scale-worlds.html) it will load only the slices around you and will deactivate/activate entites in a dynamic slice that are within your promixity.SharerePost-User-9447706answered 4 years ago0@LumberjackCC @fluffy @Vidas_MaslauskasYou can spawn a dynamic slice, then deactivate all of the entities in the hierarchy, but don't destroy the entity. Deactivated entities will still hold references to their resources.Depending on how the entities interact with your game, you could spawn them and move them very far away from the playter, and then move them in range when needed. StarterGame uses this approach with the Bullet that the player fires. It needs to appear very very quickly after player input so they prespawn it and move it far away.Another approach used in StarterGame (I'm not endorsing the approach) is to create an object pool to preload a bunch of slices and then get one from the pool and use it in the level. This is done with some particles like the muzzle flash, and with decals, such as the decal applied when the bullet hits static objects.LY probably needs to make a slice preload component that can be used be used for the purpose you're describing - preload all resources required by a slice asynchronously at runtime so that slice instantiation is immediate and with minimal IO.SharerePost-User-4357073answered 4 years ago"


Question: Creating CfnDestination with specific region using CDK

"I created a Kinesis stream and CfnDestination in my account through CDK in <region-1>.And created CloudWatch logs subscription filters in cross-accounts to stream data to my kinesis.Now for subscription filters in <region-2> accounts I will need to create CfnDestinations in <region-2>.I followed this AWS Article to achieve it through CLI. Now I want to integrate this step in my CDK code.I checked through various AWS resources/articles & went through the CfnDestination code base, but couldn't find any place in code where I can specify the region where the CfnDestination should be created.FollowComment"

Answer: "0I was able to achieve it by creating a separate deployment group for the required region and then created CfnDestination stacks inside those with the same region as deployment group. Also, added the CfnDestination Stack's dependency on Kinesis Stream stack.As I'm using CDK v1, as a work-around due to know issue described in this Github issue, I had to create a dedicated role with each CfnDestination.Problem Solved.For future, We can check if there is a way to achieve it without creating multiple roles for each region. (Or maybe this can be solved by upgrading to CDK v2).CommentSharerePost-User-6255903answered 2 months ago"


Question: Cloudfront Add Alias Issues - Invalid or missing alias DNS TXT records

"I have a cloudfront distribution without any aliases. I can add a new alias in through the console just fine. However, when I try to add the same alias via awscli or boto3 (python), I continuously get the following error:An error occurred (IllegalUpdate) when calling the AssociateAlias operation: Invalid or missing alias DNS TXT records.To add to this, the domain does not exist in Route53 but it also doesn't need to when I do it via the Console. So my usual workflow is:Create a distributionAdd an alias something like myname.domain.com and myname2.domain.comAdd route53 A record to point myname.domain.com and myname2.domain.com to the distribution ID/addressMy goal is to achieve the same without having to use the Console but I'm not able to figure it out.FollowCommentkentrad EXPERTa year agoCan you post the CLI command you are submitting?ShareAWS-User-7748349 a year agoSure,  aws cloudfront associate-alias --target-distribution-id <distribution-id> --alias myname.domain.comShare"

Answer: 0According to the associate-alias  documentation:With this operation you can move an alias that’s already in use on a CloudFront distribution to a different distribution in one step. This prevents the downtime that could occur if you first remove the alias from one distribution and then separately add the alias to another distribution.You should use the update-distribution command. Or set the alias(es) when you create the distribution.CommentShareEXPERTkentradanswered a year ago


Question: How do I access the Spark UI?

"Hello!So I enabled the Spark UI for a dev endpoint as described here:https://docs.aws.amazon.com/en_pv/glue/latest/dg/monitor-spark-ui-dev-endpoints.htmlAfter creating a GlueContext a table with a link to the Spark UI is printed in the Notebook.The link leads to:http://ip-172-32-2-76.eu-central-1.compute.internal:20888/proxy/application_123456789_0001/But requesting that site with the browser yields a "Server not Found".So, I suppose a setting is missing.I would like to see that fancy Spark UI Web Interface.Kind RegardsFollowComment"

Answer: "0If I log on to the endpoint server I can curl that URL successfully. How do I make it accessible via a browser?CommentShareRaffaelanswered 4 years ago0https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-spark-webui.htmlAn SSH tunnel is the solution ...... or lynx on the server.CommentShareRaffaelanswered 4 years ago0Sorry for late reply.The link you mentioned is for EMR, not for Glue.Actually you can access to Spark history server running on dev endpoint with SSH tunnel, but you do not need to configure it anymore.Currently Glue provides two different ways to access to Spark UI; EC2(CloudFormation) and local Docker.See details here; https://docs.aws.amazon.com/glue/latest/dg/monitor-spark-ui.htmlCommentShareAWS-User-6283168answered 4 years ago"


Question: Error when Importing ssl certificates. Step 1: Input certificate details

"I am trying to import the ssl certificate into aws, they are asking for Certificate details Info, such as certificate body, private key, and certificate chain. I Paste the PEM-encoded certificate. I keep getting the error message "The certificate body provided is not in a valid PEM format" and it won't allow me to go to next step. There seem to be no issue with Certificate private key, I am only getting error with Certificate body.FollowComment"

Answer: "0Hi, this can be for multiple reasons.1.First convert you crt file with pem formatopenssl x509 -in In private.crt -out private.pem -outform PEMsimilarly covert intermediate and rootca cert file also,2.Also, make sure the certificate chain file  has correct sequence, follow this sequence.cat inter.pem RootCA.pem > ca-bundle.pemCommentSharesouravanswered a year ago"


Question: No Internet access from instance in VPC to Internet

"Hi,I have a new instance with one Elastic IP assigned and I am not able to access the Internet. I have looked at many post detailing similar problems and from what I can tell, I have configured correctly. DNS seems to be resolving, but I am unable to ping 8.8.8.8 or seemingly access the Internet. ACL is set to allow all outbound traffic. What am I doing wrong?Instance: i-0e91522238e28c5b5Security group: sg-0f4a60a4c2d20d8aeVPC: vpc-e0618187Internet gw: igw-28b72f4cNetwork ACL: acl-bebf2bd9Routing table: rtb-a94e09ceFollowComment"

Answer: "0Hey there,Since your ACL and Security Group allow all outbound traffic, you can check the OS-level firewall to see if your windows resource is blocking requests. You can also enable VPC flow logs to have logs of all the requests leaving and coming into your VPC in order to have visuals if traffic is leaving instance or VPC and coming back.Best regardsprechCommentShareprechanswered 3 years ago0Specifically had issues with returning ICMP traffic and HTTP return traffic, determined to be problem with dynamic ports. NACL Ingress rules added for ICMP and the Windows dynamic port range (49152-65535), thus enabling outbound traffic from the instance.https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#nacl-ephemeral-portsCommentSharepeakmananswered 3 years ago"


Question: Restrict listing 5 out of 10 folders for given prefix through IAM policy

"Dear Team,I have a bucket named my-bucket and it has a users folder.  There are 5 individual user-name folder inside users folder.  I want to make sure each user gets to see his/her own folder but can not see other user folders(I can restrict access to the content of the folder but want that one user should not see other users folder as well).  Is it possible  ?Ex. Below is the folder structure i have :my-bucketusersUserAUserBUserCUserDUserEwhen UserE logs in, he/she should not see UserD folder in S3.   I am able to restrict the content view of UserD folder but UserE still sees userD folder and then on click of UserD folder, he gets access denied error.Please let me know if i can restrict UserE from seeing any other users folders if he clicks on users folderThanks,Dhaval MehtaFollowComment"

Answer: "0See: Amazon S3: Allows IAM users access to their S3 home directory, programmatically and in the consoleCommentShareEXPERTkentradanswered a year agoDhaval Mehta a year agoThis just help to restrict the content in other users folder but does not help to viewing of other users folder names.  I want UserE not to see UserD folder itself since he/she does not have access to content of that folderShare"


Question: InvalidResourceId Error When Trying to List Tags for Parameter

"Hi there. I was attempting to use the aws cli to manage tags on some SSM Parameters I had created; specifically, I was using the list-tags-for-resource command. For most parameters, this works just fine. However, I have a few parameters with a "/" in their name, e.g. "/build-number/ExcelService". When I try to try to query the tags for these parameters, I receive an error.Command:aws ssm list-tags-for-resource --resource-type "Parameter" --resource-id "/build-number/ExcelService"Error:An error occurred (InvalidResourceId) when calling the ListTagsForResource operation:(Note: the trailing colon in the error message is not a copy-paste mistake; nothing followed it in the error message).The same error is also thrown for the command add-tags-to-resource. I've tried escaping the slashes with backslashes, tried removing the leading slash, and various other modifications, but nothing avoids the error. Is there another way I should be escaping or replacing the slashes? Any other options I'm missing? Or is this simply a bug?Edited by: CMoss-VVS on Aug 16, 2019 11:02 AMFollowComment"

Answer: "0Accepted AnswerYes, my guess is also that it is the version. I also just tried on an EC2 Amazon Linux 2 with the default aws cli of 1.16.102, and it worked fine.[ec2-user@ip-172-31-81-169 ~]$ aws ssm add-tags-to-resource --resource-type "Parameter" --resource-id "/pets/dog/kukki" --tags "Key=car,Value=mazda"[ec2-user@ip-172-31-81-169 ~]$ aws ssm list-tags-for-resource --resource-type "Parameter" --resource-id "/pets/dog/kukki"{    "TagList": [        {            "Value": "mazda",            "Key": "car"        },        {            "Value": "qa",            "Key": "org"        }    ]}[ec2-user@ip-172-31-81-169 ~]$ aws --versionaws-cli/1.16.102 Python/2.7.16 Linux/4.14.123-111.109.amzn2.x86_64 botocore/1.12.92-randyCommentShareRandyTakeshitaanswered 4 years ago0Hi,I was not able to reproduce your problem in my environment.rtakeshi@DESKTOP-OT2QIS0:~$ aws ssm add-tags-to-resource --resource-type "Parameter" --resource-id "/pets/dog/kukki" --tags "Key=org,Value=qa"rtakeshi@DESKTOP-OT2QIS0:~$ aws ssm list-tags-for-resource --resource-type "Parameter" --resource-id "/pets/dog/kukki"{    "TagList": [        {            "Key": "org",            "Value": "qa"        }    ]}rtakeshi@DESKTOP-OT2QIS0:~$ aws --versionaws-cli/1.14.44 Python/3.6.8 Linux/4.4.0-17763-Microsoft botocore/1.8.48Note: when I was testing, I accidentally mispelled "pets" as "petg" and saw the following:rtakeshi@DESKTOP-OT2QIS0:~$ aws ssm add-tags-to-resource --resource-type "Parameter" --resource-id "/petg/dog/kukki" --tags "Key=org,Value=qa"An error occurred (InvalidResourceId) when calling the AddTagsToResource operation:Is there any chance that the Parameter store name does NOT match "/build-number/ExcelService"?-randyCommentShareRandyTakeshitaanswered 4 years ago0Hi Randy,Thanks for your response. Yes, I am positive the name was spelled correctly. I even copy-pasted it into the command as a sanity check. I also duplicated your parameter, and your command, exactly and I'm still getting the same error.Since there is a discrepancy in behaviour, I wonder if this is because I'm using the version of the CLI installed with pip? I made the switch a while ago because the msi-installed CLI was throwing an error on certain S3 commands (see https://stackoverflow.com/questions/53144254/aws-cli-upload-failed-unknown-encoding-idna). That's the only difference I can think of off the top of my head.CommentShareCMoss-VVSanswered 4 years ago0Yeah, seems to be a Windows thing, actually. It works when I test from a Linux EC2 instance, but I tested with some coworkers' machines and it doesn't seem to work on Windows whether the .msi or pip was used to install.Guess I won't worry about it much more at the moment, though maybe I'll file a bug report somewhere. Thanks for the help!CommentShareCMoss-VVSanswered 4 years ago"


Question: Remove trailing slashes from AWS S3 stating webhosting site

"I have generated my WordPress website as static html and deployed it to s3 bucket to serve as static website.Here is my website endpoint: wwwalls.comMy SEO team wants that the page URLs must not contain trailing slashes, but I could not find any document online that could allow me to get rid of trailing slashes from the URL eg : https://wwwalls.com/demo leads to https://wwwalls.com/demo/I tried using redirects but then it ends up in too many redirects.[    {        "Condition": {            "KeyPrefixEquals": "demo/"        },        "Redirect": {            "ReplaceKeyPrefixWith": "demo"        }    }]Please advice !FollowComment"

Answer: 1May you try this LambdaEdge function: LambdaEdgeRemoveTrailingSlash?It seems to solve your issue.You may read more about LambdaEdge here too: https://aws.amazon.com/lambda/edge/CommentShareGabriel Bartholomeuanswered 10 months agoEXPERTBrettski-AWSreviewed 10 months ago


Question: Create additional columns in athena while querying load balancer logs

"I'm using Athena to Query load balancer logs (https://docs.aws.amazon.com/athena/latest/ug/application-load-balancer-logs.html)In my request_url field I have additional parameters that I would like to use as separate columns in my table to make querying easier.Examples of my request_url:https://customer_01.example.com/api/users?agent=2.17.01&source=webhttps://customer_123.example.com/api/books?agent=1.1https://customer_42.example.com/api/locations?agent=2.02.13&source=androidI have a Route53 entry for *.example.com pointing to my load balancer. Almost all the requests contain agent and source parameters. I want to parse the url and add 4 new fields: customer, agent, agent_int, source in the table.request_urlcustomeragentagent_intsourcehttps://customer_01.example.com/api/users?agent=2.17.01&source=web12.17.0121701webhttps://customer_123.example.com/api/books?agent=1.11231.110100https://customer_42.example.com/api/locations?agent=2.02.13&source=android422.02.1320213androidWith the new fields like customer and agent_int it will be very simple for me to query the logs based on a range of values. Is it possible to parse the request_url and extract this information? Some amount of transformation is also required (e.g. agent_int = (X*100+Y)*100+Z where agent format is X.Y.Z)FollowComment"


Question: "What is the role of an these Aurora3 user ?( AWS_COMPREHEND_ACCESS, AWS_LAMBDA_ACCESS, AWS_LOAD_S3_ACCESS,AWS_SAGEMAKER_ACCESS,AWS_SELECT_S3_ACCESS) And how to change plugin of these user"

1.AWS_COMPREHEND_ACCESS2.AWS_LAMBDA_ACCESS3.AWS_LOAD_S3_ACCESS4.AWS_SAGEMAKER_ACCESS5. AWS_SELECT_S3_ACCESSI want to change these five Aurora3 mysql user's plugin from 'mysql_native_password' to 'sha256_password'.but i can't .i have two question about this issue.What is the role of an these five user ?How to change these user's plugin from  'mysql_native_password' to 'sha256_password'.Thank you.FollowComment

Answer: "0Dear Customer,Hope you are in good health.After going through the post, I understand that you  would like to know the role of these users AWS_COMPREHEND_ACCESS , AWS_LAMBDA_ACCESS , AWS_LOAD_S3_ACCESS , AWS_SAGEMAKER_ACCESS , AWS_SELECT_S3_ACCESS and you were unable to change the user's plugin from 'mysql_native_password' to 'sha256_password' for mnetioned users.Please correct me if I misunderstood your query.Please allow me to answer your query :What is the role of these five users ?Ans :  Aurora MySQL version 3  includes roles that you can use to access other AWS services. You can set these roles as an alternative to GRANT statements. For example, you specify GRANT AWS_LAMBDA_ACCESS TO user instead of GRANT INVOKE LAMBDA ON . TO user .Please review below document for more details on integrating Aurora MySQL with other AWS services :[+] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.htmlBelow are the uses of 5 users mentioned which are available in Aurora version 3 by default :AWS_LAMBDA_ACCESS role :  Used as an alternative to the INVOKE LAMBDA privilege.For usage information, Invoking a Lambda function from an Amazon Aurora MySQL DB cluster.[+] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.Lambda.htmlAWS_LOAD_S3_ACCESS role  :  Used as an alternative to the LOAD FROM S3 privilege.For usage information, see Loading data into an Amazon Aurora MySQL DB cluster from text files in an Amazon S3 bucket.[+] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.LoadFromS3.htmlAWS_SELECT_S3_ACCESS role : Used as an alternative to the SELECT INTO S3 privilege.For usage information, see Saving data from an Amazon Aurora MySQL DB cluster into text files in an Amazon S3 bucket.[+] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.SaveIntoS3.htmlAWS_SAGEMAKER_ACCESS role : Used as an alternative to the INVOKE SAGEMAKER privilege.For usage information, see Using Amazon Aurora machine learning with Aurora MySQL.[+] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/mysql-ml.htmlAWS_COMPREHEND_ACCESS role, Used as an alternative to the INVOKE COMPREHEND privilege.For usage information, see Using Amazon Aurora machine learning with Aurora MySQL.[+] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/mysql-ml.htmlWhen you grant access by using above roles in Aurora MySQL version 3, you also activate the role by using the SET ROLE role_name or SET ROLE ALL statement. The following example shows how. Substitute the appropriate role name for AWS_SELECT_S3_ACCESS.Grant role to usermysql> GRANT AWS_SELECT_S3_ACCESS TO 'user'@'domain-or-ip-address'Check the current roles for your user. In this case, the AWS_SELECT_S3_ACCESS role has not been activated.Only the rds_superuser_role is currently in effect.mysql> SELECT CURRENT_ROLE();+--------------------------+| CURRENT_ROLE()           |+--------------------------+| rds_superuser_role@% |+--------------------------+1 row in set (0.00 sec)Activate all roles associated with this user using SET ROLE.You can activate specific roles or all roles.In this case, the user only has 2 roles, so we specify ALL.mysql> SET ROLE ALL;Query OK, 0 rows affected (0.00 sec)Verify role is now activemysql> SELECT CURRENT_ROLE();+--------------------------------------------------+| CURRENT_ROLE()                                   |+--------------------------------------------------+| AWS_LAMBDA_ACCESS@%,rds_superuser_role@% |+--------------------------------------------------+How to change these user's plugin from 'mysql_native_password' to 'sha256_password' ?Ans :  As RDS is a managed service and uses ' mysql _native_password' as default. You can't change the default_authentication_plugin setting. However you can create users with specific authentication plugins and change them based on your rquirement .Unfortunately it is not possible to change the authentication plugins for these users  AWS_COMPREHEND_ACCESS , AWS_LAMBDA_ACCESS , AWS_LOAD_S3_ACCESS , AWS_SAGEMAKER_ACCESS , AWS_SELECT_S3_ACCESS as they are built in by default.For more details , please refer below document :[+] https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.AuroraMySQL.Compare-80-v3.html#AuroraMySQL.privilege-modelI hope above information was helpful . Should  you need any more information I request you to raise a case with RDS Support team and we will be happy to help you .Have a great day ahead !CommentSharerePost-User-8858586answered 6 months ago"


Question: "'AWS suggested' way to deal with object lock, glacier, and File Gateway (ie lifecycle logic / lamdbas)"

"I'm interested (somewhat linked to other questions about how uploads to the Storage Gateway in File Gateway mode work when there is a need to hash data after copying to the NFS share) in the 'AWS suggested' ways to handle the mix of File Gateway, Object locking, and Deep Glacier transitions because it feel like its easy to set up wrong, and treble storage costs inadvertently.I'm noticing for each upload, two object versions are made.I read (Here) this is because of the way data is written to NFS where the file metadata is transferred after the file contents (which the storage gateway would have already started to upload). So Before I even start looking at Lifecycle rules I already have two object versions for each file (they both seem to be of the same size, so doubling storage costs out the bat)...... not ideal...I then want to use a lifecycle rule to move data to Deep Glacier. But then I have one object version in Deep Glacier, and one version in S3 'Standard' (increasing storage costs)....I want to take advantage of object locking to protect from ransomware 100% (that is after all one advantage of WORM). However, because I now have multiple object versions I need to have lifecycle rules to delete the older versions to save on costs, BUT, if you ONLY keep the latest version, there is a significant risk of ransomware encrypting data waiting to move to Deep Glacier (as lifecycle rules only run once per day). This would create a new 'encrypted' object version, which then potentially gets moved to Deep Glacier as 'the most recent' object, and old versions (ie the un-encrypted version that represents the actually object WE uploaded and is not affected by the ransomware) are then removed leading to a mix of ransomware affected objects in Deep Glacier with no way of knowing which is and isn't...I hope that scenario makes sense?We cannot just blindly keep the most recent object version, as it could have been affected by ransomware, but we cannot, and do not, want to keep a million object versions (of which a min. of two object versions are always made because of the way NFS metadata is written 2nd)...I want to (as a side note) put legal holds onto Deep Glacier objects just because we effectively want indefinite retention, but still have the ability to remove and delete as needed when situations arise.How do AWS envisage this is supposed to work?  I would appreciate some insight as to the types of lifecycle policies, and or lambda functions that would be needed to purely from a 'system logic' perspective (ie rough ideas of what needs to be done, I'm not asking for documented examples - unless they already exist).Owen.PS. not having versioning and object locking doesn't help the main aim of protecting the data from ransomware / malicious code as another way to destroy this 'archive data lake' would be to rm -rf from the NFS mount.... which without the object locking / versioning would delete all the data.....FollowComment"

Answer: "2It sounds like you don't want to keep the millions of object version but also can't disable object versioning because of possible ransomware attacks. I'd like to propose you to use S3 Lifecycle + Intelligent-Tiering storage class.You can create a lifecycle rule to keep only certain number of versions. For instance, keep current version and additionally keep maximum five newer versions for objects aged more than 5 days. In S3 console -> lifecycle configuration, please check "Number of newer versions to retain - Optional" feature.Although Glacier Deep Archive's storage cost is cheap, it's PUT request call is quite expensive. Also, it has minimum storage duration of 180 days. In many cases, this is not a best option for many of customer unless indeed archive usage. Somehow, the request fee could be more expensive than storage cost.You may instead consider Intelligent-Tiering storage class. You can directly put objects to this class by Storage Gateway file share settings. It will automatically tiering your objects to the best storage class. In addition, you can additionally enable Archive Access tiers, which auto tier objects to Deep Archive Access Tier - same as Glacier Deep Archive storage cost. Although Intelligent-Tiering class costs for monitoring fee, considering PUT request call fee of regular Glacier Deep Archive class, this storage class can be much more cost effective. Each auto-tiering inter Intelligent-Tiering class are all free of charges.You can enable default retention for Object Lock with Governance mode. In this case, the only governed user can remove the object version within retention period. Once retention expires, any allowed user to the bucket can remove the object.CommentShareVanswered a year agoommps a year agoThank you for taking the time to respond...I'm still confused as to the best way to deal with 2 versions being created immediately when a file is copied to the File Gateway NFS, or why AWS doesn't already have a solution to mitigate this as I see NO use-case where that behaviour is actually desirable...I'm going to assume that if there was a way to delay the File Gateway 'upload' until after the file was completely written to this would then stop the 2-version thing? I can 100% see a user configurable option to either delay upload from the on prem cache by a set time (either 0 for immediate, or any integer number of minutes/hours) basically solves most issues...Object locking is an important option for archive data, but its also kind of annoying that the whole versioning thing makes lifecycle management harder.Shareommps a year agoSorry to comment again, I was just wondering if it was possible to have 'some' level of feedback from my previous comment re: dealing with the 2 object versions that are immediately created upon upload. It seems Like I may need some form of Lambda to trigger on each PUT into the bucket from the gateway to then check if the object is the newest and automatically remove the 2nd version.... it does seem a bit of a 'hacky' way to deal with a problem that (in my opinion) shouldn't really exist in the first place.....Share"


Question: How to identify CTI associated with services within one or more AWS accounts?

"Hello AWS community, our team is updating the CTI and would like to update it in AWS accounts and services. Identifying and updating the CTI at the AWS account is simple, but there are several services such as Cloudwatch Dashboards which can have a CTI different than the AWS account, so how can we easily retrieve CTI assignment across all services and objects within one or more AWS accounts? Any code or no-code solution is appreciated. Thanks!FollowComment"


Question: Problem with Apple Mail - Amazon Work Email

"Hi - I’m trying to set up my Amazon Work email account on Apple MAIl according to this procedure (https://docs.aws.amazon.com/it_it/workmail/latest/userguide/connect_mac_mail.html) but it doesn’t work.Specifically :i logged into preferencethen “add account"select “microsoft exchange"once I typed in account and psw it says that it’s impossible to verify the account.The only way to do is with IMAP procedure but this does not allow to connect calendar, noteThis does not occur on iPhone where I was able to install properly.Anyone can help me on this?FollowComment"

Answer: "0Hi,I'm sorry to hear you're experiencing problems configuring your mail account in the Mail application. Are all required domain record for you WorkMail organization created? Its important to create all domain records and for your case the autodiscover domain record which is used for automatic configuration.You can also try manual configuration, you can find the required server for Exchange Web Service here.Kind regards,RobinCommentShareMODERATORrobinkawsanswered a year ago"


Question: Our VPN tunnels changed to down on the 28th of Jan with no changes from our side

"Hi All,We have a site to site VPN connection which was working till the 28th of Jan.We have not made any changes and the client claims the same.There are no logs streams created in CloudWatch.We've gone through -https://aws.amazon.com/premiumsupport/knowledge-center/vpn-tunnel-troubleshooting/https://aws.amazon.com/premiumsupport/knowledge-center/vpn-tunnel-phase-2-ipsec/Andhttps://forums.aws.amazon.com/thread.jspa?threadID=217841However since we can't understand which phase has failed exactly we can't get a fix, could somebody help?FollowComment"

Answer: "1Accepted AnswerHello,I believe as recommended, opening a support case would be the best bet. Even Developer Plan has Email support.In any case, I would recommend checking the CGW side logs. Since Site to Site VPN also has aCustomer Gateway which is on the On-Premise device. Also check for the timestamp when the tunnels went down exactly so that you can have the debug logs and check further.Also, Was the VPN ever working ? AWS VPN has 2 phases- It will be better to proceed with the troubleshooting steps on what phase has caused an issue.Phase-1: https://aws.amazon.com/premiumsupport/knowledge-center/vpn-tunnel-phase-1-ike/Phase-2: https://aws.amazon.com/premiumsupport/knowledge-center/vpn-tunnel-phase-2-ipsec/Another suggestion would be to check the troubleshooting from the CGW side by contacting the CGW side Vendor.Hope this helps.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year agoAWS-User-Chirag SUPPORT ENGINEERa year agoI would also recommend to check for any PHD which is Dashboard notifications received during the same time with respect to the VPN.Sharefidsamurai a year agoThe fix was to create a DNAT config in the client vendor's network.I was trying to find logging for all VPN services but couldn't get anything.Could you guide me on where to find logs for the same?Share0I'd recommend that you create a support case for this - as you've been through the steps documented we (here on re:Post) don't have access to live systems in your account; but the support team can help you with that.CommentShareEXPERTBrettski-AWSanswered a year agofidsamurai a year agoWe have a basic account, so unfortunately that isn't possible either.Is there any way to understand what is going wrong with the connection?Or would deleting and recreating the VPN be a better bet?Share0Hello.AWS VPN logs are proprietary to AWS Internal VPN teams only and are not customer facing. You will have to Premium Support or contact the the accounts team to help you get the logs. However, they are not public facing and are not visible to any AWS customers despite the Support Plan level.You can use Cloud watch logs to check the tunnel Status and Tunnel Data In/Out as per the link mentioned on the public facing document.https://docs.aws.amazon.com/vpn/latest/s2svpn/monitoring-cloudwatch-vpn.htmlCommentShareSUPPORT ENGINEERAWS-User-Chiraganswered a year agofidsamurai a year agoUnderstood, thanks!Share"


Question: Creating aws context for Deploying Docker containers on ECS

"hi Guys,I am trying to run the follwowing command:  docker context create ecs myeccontext but get the below error:"docker context create" requires exactly 1 argument.See 'docker context create --help'.Usage:  docker context create [OPTIONS] CONTEXTCreate a contextI’m running docker on MacOS Monterey 12.5.1docker --versionDocker version 20.10.17, build 100c70180fThank you.FollowComment"

Answer: "0Greetings,Looking at the help for this command in docker the example:docker context create my-context --description "some description" --docker "host=tcp://myserver:2376,ca=~/ca-file,cert=~/cert-file,key=~/key-fileI was able to create a context usingdocker context create myecsmyecsSuccessfully created context "myecs"And for ecs docker context create ecs myecscontext? Create a Docker context using: An existing AWS profile? Select AWS Profile myuser-adminSuccessfully created ecs context "myecscontext"I have Docker Desktop 4.5.0 (74594) and docker client version 20.10.12 on Mac M1 arm64. I also have docker compose docker-compose version 1.29.2, build 5becea4c installed.Check out this blog Deploy applications on Amazon ECS using Docker Compose as it has a walk through on contexts.CommentShareAWS-JRG-1317534answered 8 months agoxender2022 8 months agohi,thank you for you answer but I am still not able to create ecs context.I am able to create myecs as you did above.I too am running Mac M1.Here is my aws configure list:Name                    Value             Type    Location----                    -----             ----    --------profile                <not set>             None    Noneaccess_key     ****************3QVK shared-credentials-filesecret_key     ****************dwxQ shared-credentials-fileregion                us-east-1      config-file    ~/.aws/config ~/ docker context create ecsecsSuccessfully created context "ecs" ~/ docker context create ecs myecscontext"docker context create" requires exactly 1 argument.See 'docker context create --help'.Usage:  docker context create [OPTIONS] CONTEXTCreate a contextI don't understand, what am I missing?ShareAWS-JRG-1317534 8 months agoDo you have docker compose installed?If not please install it https://github.com/docker/compose-cli/blob/main/INSTALL.mdSharexender2022 8 months agohi, it says if you have docker desktop installed, it comes with the following:Docker Desktop includes Docker Engine, Docker CLI client, Docker Build/BuildKit, Docker Compose, Docker Content Trust, Kubernetes, Docker Scan, and Credential Helper.Here is the docker full info: /usr/local/bin/ which docker/opt/homebrew/bin/docker /usr/local/bin/ docker versionClient: Docker Engine - CommunityVersion:           20.10.17API version:       1.41Go version:        go1.18.3Git commit:        100c70180fBuilt:             Mon Jun  6 21:36:39 2022OS/Arch:           darwin/arm64Context:           defaultExperimental:      trueServer: Docker Desktop 4.12.0 (85629)Engine:Version:          20.10.17API version:      1.41 (minimum version 1.12)Go version:       go1.17.11Git commit:       a89b842Built:            Mon Jun  6 23:01:01 2022OS/Arch:          linux/arm64Experimental:     falsecontainerd:Version:          1.6.8GitCommit:        9cd3357b7fd7218e4aec3eae239db1f68a5a6ec6runc:Version:          1.1.4GitCommit:        v1.1.4-0-g5fd4c4ddocker-init:Version:          0.19.0GitCommit:        de40ad0ShareAWS-JRG-1317534 8 months agoI noticed in your provided examples you do not get the prompt for choosing an AWS profile or credential when creating the ECS context. can you verify the AWS CLI is installed?Looking at the official docs here https://docs.docker.com/cloud/ecs-integration/ and on this section https://docs.docker.com/cloud/ecs-integration/#create-aws-context it should be prompting you for credentials.Share0hi,you are correct, I do not get the prompt.my aws cli version:aws-cli/2.7.35 Python/3.9.11 Darwin/21.6.0 exe/x86_64 prompt/offDo you think I am missing anything on the AWS side? I tried following this instruction: https://docs.docker.com/cloud/ecs-integration/#requirements(sorry, my userid changed when I had to login again)CommentShareaws-User-1334385answered 8 months ago"


Question: Simple AD directory not deleting.

"I have a Simple AD directory not deleting, it's been stuck in the deleting stage for 5 hours.Is there any way I can force delete it, do I just wait, or do I need AWS to delete it for me ?Any advice?Many Thanks.FollowComment"

Answer: "0Sorted - cleared through AWS CLICommentShareAWSALCanswered 2 years agoaws_ez 8 months agoWhat was the command you used, as Im having this problem?Share0Hello There,Thanks for the update.We are glad that you were able to resolve the issue.ThanksCommentShareRobin-Panswered 2 years ago0Hi,I have the same issue.I have a deleting directory message in my console for a long time.I do not believe I am being charged for this directory though.To the best of my knowledge I have removed any dependancies that would prevent it from being removed.When I say long time I am talking a period of months as I have not visited this service in a long time.CommentShareKhronosanswered 2 years ago"


Question: ALB: unexpected 504 timeouts.

"Hello, we're running an application with the following setup:ALB -> TargetGroup -> ECS serviceThe ECS service is running on Fargate and it is a web-server.The ALB timeout is set to 20 seconds, and the Service's idle timeout is set to 120 seconds. We've confirmed that the ECS service keeps connections open for at least 120 seconds.We've also configured request logging on this ALB and we've been querying it with Athena.However, it seems like the ALB still issues 504s to some requests immediately, we regularly see log entries like these:#typetimeelbclient_ipclient_porttarget_iptarget_portrequest_processing_timetarget_processing_timeresponse_processing_timeelb_status_codetarget_status_codereceived_bytessent_bytesrequest_verbrequest_urlrequest_protouser_agentssl_cipherssl_protocoltarget_group_arntrace_iddomain_namechosen_cert_arnmatched_rule_priorityrequest_creation_timeactions_executedredirect_urllambda_error_reasontarget_port_listtarget_status_code_listclassificationclassification_reason1h22022-04-05T12:29:35.833859Zapp/ProdV2PublicApi/0a57bb243c2024e7REDACTED6023210.42.17.243180000.001-1.0-1.0504-307202PUThttps://apibeta.centralapp.com:443/api/v2/inbox/table-booking/request-status?urn=urn%3Acentralapp%3Acompany%3A9211291968452165724HTTP/2.0Mozilla/5.0 (Windows NT 6.0; rv:52.0) Gecko/20100101 Firefox/52.0ECDHE-RSA-AES128-GCM-SHA256TLSv1.2arn:aws:elasticloadbalancing:eu-west-1:899041400740:targetgroup/ProdV2-Quasar-ECS/3ee8cde1808fdb22Root=1-624c35f3-5852eff9590d1fd5285bc6e7apibeta.centralapp.comarn:aws:acm:eu-west-1:899041400740:certificate/7f1122d9-2470-46d6-b28b-53a48c99bdd152022-04-05T12:28:35.831000Zwaf,forward--10.42.17.243:18000---From the backend logs, it seems to us that the request never really gets to the ECS service, or from the ECS service's standpoint, the connection gets prematurely terminated by the ALB.For the premature termination, we see logs in our backend like these:[CRITICAL] [05/Apr/2022:10:18:47 +0000] ["Quasar/###WARP###"] Exception on request:Just Request    { requestMethod = "POST"    , httpVersion = HTTP/1.1    , rawPathInfo = "/api/v2/distributor/companies/d-sales/leads"    , rawQueryString = "?id=centralapp_saas&page=0"    , requestHeaders =        [            ( "X-Forwarded-For"            , "217.111.215.151"            )        ,            ( "x-amzn-tls-version"            , "TLSv1.2"            )        ,            ( "x-amzn-tls-cipher-suite"            , "ECDHE-RSA-AES128-GCM-SHA256"            )        ,            ( "X-Forwarded-Proto"            , "https"            )        ,            ( "X-Forwarded-Port"            , "443"            )        ,            ( "Host"            , "apibeta.centralapp.com"            )        ,            ( "X-Amzn-Trace-Id"            , "Root=1-624c1784-223215ba597701b31758046f"            )        ,            ( "Content-Length"            , "40"            )        ,            ( "sec-ch-ua"            , "" Not A;Brand";v="99", "Chromium";v="99", "Google Chrome";v="99""            )        ,            ( "content-type"            , "application/json; charset=UTF-8"            )        ,            ( "sec-ch-ua-mobile"            , "?0"            )        ,            ( "user-agent"            , "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36"            )        ,            ( "sec-ch-ua-platform"            , ""macOS""            )        ,            ( "accept"            , "*/*"            )        ,            ( "origin"            , "https://beta.centralapp.com"            )        ,            ( "sec-fetch-site"            , "same-site"            )        ,            ( "sec-fetch-mode"            , "cors"            )        ,            ( "sec-fetch-dest"            , "empty"            )        ,            ( "referer"            , "https://beta.centralapp.com/"            )        ,            ( "accept-encoding"            , "gzip, deflate, br"            )        ,            ( "accept-language"            , "fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"            )        ,            ( "x-amzn-waf-name"            , "ACL_Public_Resources_Default"            )        ]    , isSecure = False    , remoteHost = 10.42.17.44:12692    , pathInfo =        [ "api"        , "v2"        , "distributor"        , "companies"        , "d-sales"        , "leads"        ]    , queryString =        [            ( "id"            , Just "centralapp_saas"            )        ,            ( "page"            , Just "0"            )        ]    , requestBody = <IO ByteString>    , vault = <Vault>    , requestBodyLength = KnownLength 40    , requestHeaderHost = Just "apibeta.centralapp.com"    , requestHeaderRange = Nothing    }Exception was:Warp: Client closed connection prematurelyWe've also tried setting things up without an ALB and we've not been able to reproduce this issue locally, so we're pretty suspicious of what the ALB is doing here.What should be our next course of action on this issue?We're also noticing that the ALB tries to keep some connections open longer than the timeout:[DEBUG] [05/Apr/2022:12:58:32 +0000] ["Quasar/###WARP###"] Socket: 10.42.17.105:39070 was open for: 90.897913261s[DEBUG] [05/Apr/2022:12:58:35 +0000] ["Quasar/###WARP###"] Socket: 10.42.2.83:56654 was open for: 107.734655922s[DEBUG] [05/Apr/2022:12:58:38 +0000] ["Quasar/###WARP###"] Socket: 10.42.2.83:56552 was open for: 129.749085682s[DEBUG] [05/Apr/2022:13:14:17 +0000] ["Quasar/###WARP###"] Socket: 10.42.17.105:41128 was open for: 625.691958838sWhy?FollowComment"

Answer: "0ALB sends 504s for the following reasons[1]:The load balancer failed to establish a connection to the target before the connection timeout expired (10 seconds).The load balancer established a connection to the target but the target did not respond before the idle timeout period elapsed.The network ACL for the subnet did not allow traffic from the targets to the load balancer nodes on the ephemeral ports (1024-65535).The target returns a content-length header that is larger than the entity body. The load balancer timed out waiting for the missing bytes.The target is a Lambda function and the Lambda service did not respond before the connection timeout expired.In your case, it looks like the ALB was not able to establish the connection with your ECS service with in the connection timeout period of 10 seconds. target_processing_time and response_processing_time entries in your Access log confirms the same[2].Capture VPC flow logs on the ENIs of ALB to find out the time difference between the request and response from ALB to ECS service.References:[1] Troubleshoot your Application Load Balancers - HTTP 504: Gateway timeout - https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html#http-504-issues[2] Access logs for your Application Load Balancer - Syntax - https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#access-log-entry-syntaxCommentSharepraneshjanswered a year ago"


Question: Injecting Sensitive data as Environment Variables to Lambda Functions

"We are used to injecting sensitive environment variables into ECS tasks via Secrets Manager like this but, we are searching for a similar way to do so for Lambda functions and, came across with this post which, seems like a lovely way of doing it. Still, we have a few questions about it:James Beswick's post is less than 45 days old, so I think there is no out of the box solution for this directly from lambda service, am I right? If so, could this be added as a customer feature request, please? It's so usual that I don't know why it's not yet available.Does this work for any lambda deployments? I mean precisely ZIP and Docker-based ones as I'm not sure how Layer set environment variables are passed (or not) to a docker container, for example.FollowComment"

Answer: "3Hi,If you're using CloudFormation to deploy your lambda functions, you can use dynamic references as per this section of the documentation.Example using AWS SAM (with some properties omitted for brevity):Resources:  MyFunction:    Type: AWS::Serverless::Function    Properties:      [...]      Environment:        Variables:          SECRET_STRING: '{{resolve:secretsmanager:my/secret:SecretString:secretkey}}'CommentShareNiklasanswered a year agoGVasquez a year agosounds like a great option, as we are using CloudFormation... now it's time to test that solutionShareJerome VDL a year agoIf you use this one, don't forget to use a kms key to encrypt the environment variable, so that no one can read the value (except the function). With SAM or cloudformation, specify "KmsKeyArn".Unless you have a good reason, you should retrieve the secret from secret manager inside your function, like MG said (or using the solution provided by James in the blog post). If the secret changes (for example after a rotation), your Lambda function won't be updated and you won't retrieve the latest value...ShareNiklas a year agoI consider the secrets as part of the contract in a sense. If you want to retreive inside the function, then SSM Parameter Store is a more cost-effective solution. A solution to changing secrets is to version your secrets by adding a version suffix, as suggested by the docs, but it's good that you highlighted that!Share2A different option for both, Lambda and ECS can be dynamically read from SecretsManager in the code of your application instead of using Environment Variables.You need to add a policy to IAM Role for Lambda and TaskRole to access SecretsManager. Then you can get the value using AWS SDK.An advantage of this solution is that even if the secret change, you can refresh it in the app, so you don't need to redeploy the app. It is also more secure because the secret is not visible anywhere in plain text.A disadvantage is that it can cost more because you will pull the value more often but it can be cached. Example in .net.Or a more cost-efficient solution with SSM Parameter Store.CommentShareMGanswered a year agoGVasquez a year agosorry MG, but that's exactly what we don't want to doShareMG a year agosure, if it's a better option for you. Then follow advice from Niklas and Jerome :)Share0I faced the same issue on my lambdas and I chose to use SSM Parameter store Secure Strings instead of Secrets Manager for the following reasons.Cost. Each secret costs .50 per month whereas secure strings are essentially free (each 10000 decrypts costs .05)Consolidated storage. I have all my other lambda parameters in the parameter store so everything is in one place.Now the only env variable I pass to my lambda is the region where the parameters are stored. When the lambda starts, it calls the store and gets everything it needs.The main advantage of secrets manager is auto rotation of passwords. When the password rotates AWS takes care of updating secrets manager. Using Parameter Store you would need to change the password manually or create a lambda function to update it.  This is not a major concern for my use case.Just one point worth noting. Put your API calls to the Parameter Store or Secrets manager into some type of init function instead of the handler so the API is only called once when the lambda starts instead of every time the handler is called.CommentShareJacksonanswered a year ago0If you want to pass sensitive information to lambda, you can't pass this directly as plain text to lambda. This is because your sensitive data will be visible in environment variables section of aws lambda service in aws console.Instead, you can use either Parameter store or Secret Manager to store the secrets and pass the ARN of the secret as environment variable to AWS Lambda and your lambda can fetch the secret by communicating with respective service.Please note that your lambda should have necessary role to communicate and fetch the secret. I've written detailed step-by-step guide to do the same here - https://www.cloudtechsimplified.com/environment-variables-secrets-database-password-aws-lambda/CommentSharemugiltsranswered 6 months ago0You can use either Parameter Store or Secret manager for storing the secret and within your lambda function - you can retrieve the secret dynamically and use that secret accordingly.I've written detailed step by step guide on how to use this here -https://www.cloudtechsimplified.com/environment-variables-secrets-database-password-aws-lambda/CommentSharemugiltsranswered 6 months ago"


Question: Quicksight Dataset suddenly cant refresh from S3 anymore

"I have a Quicksight dataset that’s been working fine for months pulling data from S3 via a manifest file but all of a sudden all the refreshes started failing with the errors below since yesterday:FAILURE_TO_PROCESS_JSON_FILE=Error details:S3 Iterator: S3 problem reading dataI’ve double checked the manifest file format and the S3 bucket permissions for Quicksight and everything seems fine and nothing has changed on our end for this to suddenly stop working out of the blue…Manifest file:{"fileLocations": [{"URIPrefixes": ["https://s3.amazonaws.com/solar-dash-live/"]}],"globalUploadSettings": {"format": "JSON"}}The error I get in the email alert is different and says "Amazon QuickSight couldn't parse a manifest file as valid JSON." However I verified that the above JSON is formatted correctly.Also, if I create a new dataset with the same manifest file, it will show the data in the preview tool but its just the Refresh that fails so clearly the manifest file is formatted correctly if Quicksight is able to initially pull data from S3 but only fails later.FollowCommentCarlo Mencarelli 4 months agoIs the data in S3 encrypted with a KMS key? I've found I've received similar errors when having encrypted data, and Quicksight didn't have access to the key (either identity based or resource-based denials)SharerePost-User-9071258 4 months agoThanks for the suggestion but I never set it up to be encrypted unless something changed completely on its own. I haven't changed anything in AWS configuration and these errors suddenly began out of the blue. Very strange. I guess I'm just going to have to cave and pay for AWS support.Share"


Question: Wordpress broken on Lightsail distribution CentOS / Server is multi host

"It seems that there's nothing on the Internet that I can find about this. Everyone is either saying use the Wordpress Lightsail instance, or Amazon Linux.. I am in the middle of migrating my server from another hosting company to Lightsail because I love AWS and I saw Lightsail is much cheaper and integrates with CloudFront, etc. all that good stuff.So I created an instance with CentOS OS only, installed everything I need-- Apache, MySQL, etc. and I migrated Wordpress over from the other server. Moved the database over, created a user, fixed the wp-config.php etc. etc. the way you'd migrate WP to another server.I have DNS working for the domain, and I configured a distribution and created a certificate and the distribution is pulling HTTP only. The original WP had SSL so I changed the siteurl and sitehome in the DB to be http and not https as they were on the old setup.When I go to the site both frontend and backend (wp-admin) it has no CSS and looks horrid and just is all kinds of broken with hundreds of insecure content errors accumilating in the js console which are from wp-includes/js/......I tried where it said to put the code in the wp-config.php for SSL termination which is this code here:define('WP_SITEURL', 'https://' . $_SERVER\['HTTP_HOST'] . '/');define('WP_HOME', 'https://' . $_SERVER['HTTP_HOST'] . '/');if (isset($_SERVER['HTTP_CLOUDFRONT_FORWARDED_PROTO'])&& $_SERVER['HTTP_CLOUDFRONT_FORWARDED_PROTO'] === 'https') {$_SERVER['HTTPS'] = 'on';}  But it doesn't fix the site.. It just makes things a tiny bit better but there's still a ton of broken CSS and the whole thing is broken.     I'm not using the really simple ssl plugin or anything I checked.. So I have no idea what is going on.    but I wanted CentOS because I'm RHEL and I wanted to stick with stock CentOS and I have other websites and uses for that server I'm not just running wordpress on it.. In fact I hate WP so this is the only WP site on here. but I have migrated dozens of wordpress sites and never had issues. I'm stumped here.    Please help. Thx.    Edited by: Alex on May 21, 2021 6:34 PM    Edited by: Alex on May 21, 2021 6:37 PMFollowComment"

Answer: "0Ok so the answer to my problem is specified on this Stack Overflow page:https://stackoverflow.com/questions/55024367/cloudfront-ssl-issue-on-wordpress-too-many-redirectsI post that because I couldn't for the life of me figure out how the markdown works on these forums to post code. It keeps on posting some links for some reason but doesn't recognize backticks for posting code.Anyhow, the lines specified need to be put above the "require_once ABS_PATH . 'wp-settings.php';" line..As for the WPSITE and WPHOME things they are originally set to https in the database so I don't need to put them in wp-config.php ..Funny all I did was move that and it works perfectly. :) I'm just psoting this here for anyone else who might have this problem.CommentShareAlexanswered 2 years ago0Ok so the answer to my problem is specified on this Stack Overflow page:https://stackoverflow.com/questions/55024367/cloudfront-ssl-issue-on-wordpress-too-many-redirectsI post that because I couldn't for the life of me figure out how the markdown works on these forums to post code. It keeps on posting some links for some reason but doesn't recognize backticks for posting code.Anyhow, the lines specified need to be put above the "require_once ABS_PATH . 'wp-settings.php';" line..As for the WPSITE and WPHOME things they are originally set to https in the database so I don't need to put them in wp-config.php ..Funny all I did was move that and it works perfectly. :) I'm just psoting this here for anyone else who might have this problem.CommentShareAlexanswered 2 years ago"


Question: How to Helth Check Rest IAM Certificated API

"How to health check IAM authenticated REST API using Route53?I created a Rest API that requires IAM authentication for the API Gate Way.I want to check the health of Rest API.There are 2 options, one is using Route53's health check, and other is cloudwatch Synthetics.I want to use Route 53's health chek if possible because of cost and ease of maintenance.Is there any way to do a health check by Route53 ?Can I set a IAM policy that certificate rest API on Route 53 orcan the health check call include credentials?FollowComment"


Question: Step function passing parameters

"Hi there,I am trying to do some experiments to migrate from the data pipeline to the step function.I call the step function from the lambda function by passing a couple of parameters (name, env). My question is, how do I pass these parameters and clusterID (from the emr) to all next steps and use it? Also, is it possible to change the name of the cluster to the parameter I passed from the lambda function? Like"Parameters": {        "Name": "$.name",....?Please see the attached picture.FollowComment"

Answer: "0Hello there!In order to pass the parameters from one state to the next, ensure that you are using the Pass state.Let's say I have the parameters ClusterName and ClusterId and I need to pass it to the next state. In my state machine definition, it will like the following:    "GetInputFromLambda": {      "Comment": "This state gets the parameters from the Lambda function",      "Type": "Pass",      "Parameters": {        "ClusterID.$": "$.ClusterId", (this allows me to get the value defined in the Lambda function)        "ClusterName.$" : "$.ClusterName",      },      "Next": "DoSomethingWithLambdaInputState"If I defined "ClusterID.$" as "ClusterID", I will get the literal string "$.ClusterId", have a look at the example listed here. The values that I get from Lambda are passed on to the next state "DoSomethingWithLambdaInputState"So if you change the name of the EMR cluster in your Lambda function, remember the key value pair so you can access it in the state machine.CommentShareJBanswered 2 months agorePost-User-9449669 2 months agoThanks JB,  So, will this one pass those parameters for the next step or all subsequent steps?Share"


Question: I cannot find ALB metric TargetConnectionErrorCount mentioned in the docs

Here it is mentipned https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html#target-metric-table TargetConnectionErrorCount but when I use metric explorer I cannot find it.Although all other metrics exist.FollowComment

Answer: "0As per documentation it says "Reporting criteria: There is a nonzero value" So that means, this metric will only emit data points if there is more than 0 data points. So right now there are no TargetConnectionError , that is why you dont see any metric. Once there are errors, you will see them.CommentShareMuhammadanswered 4 months ago"


Question: "is there a service role that needs to be attached to AWSCodeCommitPowerUser policy for codecommit , we are integrating with Jenkins and with only policy the code /repo is not getting checked out"

"Got started with creating a repo using codecommit , respective users (IAM) with needed policy AWSCodeCommitPowerUser. Also have integrated Jenkins in aws ec2instance using the security credentials of the IAM user. The issue is that code is not getting checked out. There is a old post on code commit integration with jenkins https://aws.amazon.com/blogs/devops/integrating-aws-codecommit-with-jenkins/ (mentions service role tagging with policy) however there is no mention of the same in the current info centerFollowComment"

Answer: 0We can close this question as no service role needs to be attached. The question arose based on the old post https://aws.amazon.com/blogs/devops/integrating-aws-codecommit-with-jenkins/ refer sentence  "Create an Amazon EC2 service role named CodeCommitRole and attach the managed policy" in the article.CommentShareThulsi DossKrishnananswered a year ago


Question: How to migrate a Microsoft SQL server with custom deployed stored procedure to RDS for Microsoft SQL SERVER

"Hi,We are evaluating to migrate our dot net framework based application using the SQL server as data base to AWS cloud.We are evaluation the RDS for SQL server as possible option for database , however the current application has a of dependency on custom build stored procedure ( keeping a lot of business logic) . Can we use RDS option for SQL server has option to use custom stored procedures and function . Also is there option to migrate the data as well as SP and function  to RDS for SQL server.Unfortunately , I do not have much exp with SQL server and Window based application , hence i am bit clueless .Any help would be appreciatedFollowComment"

Answer: "1Hi ThereThere are a few ways to do the migration from SQL Server to RDS SQL.  The easiest way would probably be a backup/restore which would include your database objects like stored procedures, as well as the data.  See https://docs.aws.amazon.com/dms/latest/sbs/chap-manageddatabases.sql-server-rds-sql-server-full-load-backup-restore.htmlCommentShareEXPERTMatt-Banswered 5 months agoIknownothing 3 months agoHey Matt , Thanks for the pointing out to the documentation. Since , it's took some time for me to comment as i wanted to test the solution.Yes the backup and restore keeps the original objects so in theory it works but we had some libraries and utilities that were not natively supported by the RDS versions , hence we need to refactor some stuffs .Share"


Question: Storage lens not accurate

"Hi,have you seen this case where for massive S3 bucket with high rate of change being replicated to another region, Storage lens may show that the replication is not finished.But when you check the bucket directly, all buckets are in-synch.Could it be that CRR replication has a possible lag of 15 mins ?FollowComment"

Answer: "0Accepted AnswerStorage lens metrics are published once a day, so it could take 24 hours. Check the blue box on this page.Monitor S3 Storage Lens metrics in CloudWatchCommentShareMichael_Kanswered a year agoEXPERTJames_Sreviewed a year ago0The answer above and the page linked both fail to state when the S3 situation is snapshotted to produce the daily summary provided in the default Storage Lens, and the Storage Link default report itself only states a date, not a time of day.CommentShareAWS-User-4644975answered 4 hours ago"


Question: Caching against Mariadb

"In a database instance for Mariadb, what is the best strategy for caching?FollowComment"

Answer: "1Hi,Are you using RDS for MariaDB or self managed please? In either case depending on the performance requirements and the use case, I suggest looking at elasticache https://d1.awsstatic.com/product-marketing/caching-database-caching-diagram.70a0c9d62877d7a32bf1024d00561eb5b560a45d.PNG and try and make add a distributed caching layer (if your application needs it)CommentShareArunanswered 3 months ago"


Question: How to reduce SSL handshake time?

"Hi,I have an HTTPS server on EC2 and I want to reduce the SSL time of this website. The SSL certificate has been installed on Tomcat 7.When i monitor on chrome network tab i see that ssl handshake is taking long time.How can i reduce SSL handshake time?FollowComment"

Answer: "0Hi ThereAre you monitoring the performance of the EC2 instance?  Are you seeing increased load or resource exhaustion?  One thing you can try is placing an Application Load Balancer in front of your EC2 instance and offloading SSL.  This way your EC2 instance does not need the extra resources for encryption, its all handled by the load balancer.Additional Resources:https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancer-getting-started.htmlCommentShareEXPERTMatt-Banswered 3 months agorePost-User-9659842 3 months agoHello,Thanks for answer but I got an error message on chrome" ... has been blocked by CORS policy: No 'Access-Control-Allow-Origin' "Share0Hi,I agree with the previous suggestion that using an Application Load Balancer may speed up your SSL handshake (among other benefits).I will also suggest that https://aws.amazon.com/cloudfront/getting-started/EC2/ will likely speed up your SSL handshake.  This is because the client's TLS is terminated at an edge location geographically closer to the client.  It may also speed up other aspects of your site/portal/service because the communication from the edge location to your EC2 instance will take place over the Amazon network rather than the general Internet.Also, I see documentation that TLS v1.3 has a faster handshake than TLS v1.2, so perhaps make sure your site supports TLS v1.3.Regards,RyanCommentShareRyan_Manswered 3 months ago"


Question: Kinesis Video Stream

"I followed the instruction on the link:https://catalog.us-east-1.prod.workshops.aws/kinesis-video-streams/en-US/3-stream/6-s3-delivery, but i did not see images on s3 bucket. Could you help me what I am missing?FollowComment"


Question: How to monitor bounces and complaints with CloudWatch?

I can't monitor bounces and complaints with CloudWatch on AWS SES.It doesn't show graphs like the old interface did. How to recover the same data visualization as with  the former interface?FollowComment

Answer: "1Hello,Choose Account Dashboard in the left navigation bar of the Amazon SES console. You should be able to see both, Bounces and Complaints metrics down below on the page.If otherwise, could you please share a screenshot of what you see?CommentShareEXPERTShree_Canswered a year ago"


Question: slow bandwith on network to internet

"i sign on t3.nano by migration of free account, but my connections to the internet continue with very slow speed. Please, help me, the t3.nano is up Up to 5 Gigabit on networ performance!SOrry on my english language is wrong. Please help me!FollowComment"

Answer: "0Hi,as you mentioned bandwidth is up to 5 Gbps. That is the burst bandwidth which is available for a certain amount of time but not permanently. The bandwidth also depends to what destination you are connecting to. For more information, please see Amazon EC2 instance network bandwidth.When you need a consistent 5 Gpbs bandwidth you can choose another instance type.Cheers,PhilippCommentSharePhilipp Sanswered 4 months ago"


Question: AWS Certificate Manager Price

I need help with the below rather than being diverted to the pricing calcI want to generate a certificate for a website for https for my AWS lightsail Instance and install it on the instance not a load balancer etc . The question is it free or will I be charged as 400 a month is a lot when go daddy do it much much cheaperprivate certificates and Amazon-issued certificates.FollowComment

Answer: "0Accepted AnswerHi Java-LTJTLS certificates generated by AWS Certificate Manager are free, but can only be used on AWS services.There is a related service called AWS Private Certificate Manager which will charge for the certificate authority itself on a monthly basis $400 or $50 if in short-lived mode. These certificates are meant to be used for internal applications and would not be trusted by browsers unless the CA certificate is installed in them. This would not be what you would be using for a public website.If you have further questions, feel free to ask! If I have satisfactorily answered your question please mark the answer as accepted.CommentSharerePost-User-5866180answered 2 months agoEXPERTalatechreviewed 2 months ago0If you want to install a certificate on your server consider using letsencrypt. AWS Certificate manager certificates can only be used by AWS services and can't be exported to install on ec2 instance or lightsail.The private certificates are usually used internally and not what you need for your website.CommentSharehameedullahanswered 2 months agoJava-LTJ 2 months agoSo where can I get a https cert then either for free or go daddy do it for like 49£ a year compared to Amazon 400 monthly? I went to letsencrypt no option to create one? Thanks so farShareVarun_R 2 months agoThe below doc has some steps for requesting Let's Encrypt certificates for Lightsail instances that may help.https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-using-lets-encrypt-certificates-with-lampShare"