Question: Is it possible to insert an image as a background with AWS media convert

I have a PNG image that is 1920x1080 and an mp4 file that is 1280x720.  Is it possible to insert the image behind the video so that it acts as a border around the video?FollowComment

Answer: "0AWS MediaConvert does offer the ability for image insertion, both as a static image or as a motion image. You can find details about the image insertion ability herehttps://docs.aws.amazon.com/mediaconvert/latest/ug/graphic-overlay.htmlThere is also the choice of input overlay vs output overlay.https://docs.aws.amazon.com/mediaconvert/latest/ug/choosing-between-input-overlay-and-output-overlay.htmlAs to using a larger image to insert around a smaller source, that may be challenging. Input sources will be scaled up or down to the output resolutions. Adding a 1920x1080 image edge overlay to a 1280x720 source, with an output of 1920x1080, would have that edge image covering the scaled up borders of 1280x720 source.CommentShareMike-MEanswered 5 months ago"


Question: Amazon Monitron Mobile App

"Can the Amazon Monitron App be integrated onto Grafana? If so, what would the steps be? I understand the Monitron can, but can the app be integrated as well? I appreciate any theories/answers. Thanks in advanceFollowComment"

Answer: 0Could you please elaborate which aspects of the Amazon Monitron app you want to integrate with Grafana?Monitron is an end-to-end system and the companion mobile app is used to set up the devices and track potential failures in your machinery. You can use the provided options to access your raw data outside of Monitron to integrate with Grafana and replicate certain feature that the companion app offers out-of-the box.Could you please describe your use-case in more detail?CommentShareJohann Fuechslanswered 14 days ago


Question: Can´t allocate dedicated host AWS EC2 for Mac instance

"Hello there !I'm trying to deploy a AWS EC2 Mac instance. During the process of setting the instance up, I get asked to allocate a dedicated host for it. When I try to do it, I keep getting the following message:Your request for accessing resources in this region is being validated, and you will not be able to launch additional resources in this region until the validation is complete. We will notify you by email once your request has been validated. While normally resolved within minutes, please allow up to 4 hours for this process to complete. If the issue still persists, please let us know by writing to aws-verification@amazon.com for further assistance.It's been more than 4hours.FollowComment"

Answer: "1It looks like your request for accessing resources in the region is still being validated, which is causing the issue. You can try reaching out to AWS Support for assistance by emailing aws-verification@amazon.com. Provide them with information about the issue, including the error message and the time frame that has passed since the validation request was made. They may be able to help you resolve the issue and allocate a dedicated host for your EC2 instance.CommentShareDivyam Chauhananswered 4 months ago"


Question: How to deploy existing application on AWS IoT Greengrass?

"I have an existing application for video analysis. It can already run on localhost (e.g. localhost:3000). Now I'm trying to deploy it on AWS IoT Greengrass, and let this application run on a port of Greengrass (e.g. www.greengrass.com:3000).Is it possible to do so? If yes, can anyone tell me the procedure and what program I need to install?Thank you very much!!P.S. I can only deploy it on Linux.FollowComment"

Answer: "0You should explore to develop AWS IoT Greengrass components [1] and update your application to be deployed as a component. Every component is composed of a recipe and artifacts. The recipe file defines the component‘s metadata. This includes the component’s configuration parameters, component dependencies, lifestyle, and platform compatibility. The lifecycle defines the commands to install, run, and shut down the component. It can be defined in YAML and JSON format. Artifacts are optional and consist of component binaries and may include scripts, compiled code, static resources, and any other files that a component consumes. Refer to 5 tips to build AWS IoT Greengrass v2 Components [2]There is also a sample workshop/tutorial which you can refer and see if you can utilize for your app [3]https://docs.aws.amazon.com/greengrass/v2/developerguide/develop-greengrass-components.htmlhttps://aws.amazon.com/blogs/iot/5-tips-to-build-aws-iot-greengrass-v2-components/https://catalog.us-east-1.prod.workshops.aws/workshops/5ecc2416-f956-4273-b729-d0d30556013f/en-US/chapter4-createfirstcompCommentShareEXPERTAWS-User-Nitinanswered 6 months agorePost-User-9637836 6 months agoAs I'm unable to use sudo in Linux, is there any other way to do so?Sorry for forgetting to mention that!Share0Hi,if you have installed Greengrass on the machine, you should be able to run your application as a component with the same permissions and user requirements that you would use in case you were running the application directly from the host.By default components in Greengrass are executed by ggc_user:ggc_group or whatever user and group was specified during the AWS Greengrass core software installation.This user and group can also be overridden during deployment on a component by component basis, by specifying an alternative user and group as part of the component configuration (see https://docs.aws.amazon.com/greengrass/v2/developerguide/create-deployments.html - runWith).In the console (as part of the deployment wizard):Cheers,MassimilianoCommentShareEXPERTMassimilianoAWSanswered 6 months agocespar 4 months agoCan you explain how to lauch application from components? I have the same questiong, I'm using zigbee2mqtt aplication on edge, which runs in port 8080, It would like wonderful if we would are able to access in remote mode. Would it be possible?Regards!Share"


Question: How to import Postgres data that has JSON columns?

"Hi everyone,We're interested in copying data from our Postgres database into a Redshift cluster, however we use a couple of redshift-unsupported column types in a few of our tables.One is a bigserial (how are the rest of you handling that one?) and the really tough one to swallow is one of our columns is a JSON type.That JSON column has a lot of important data for us.  May I ask how others here are dealing with the challenge of getting that data into redshift, any recommended approaches?  Thanks much.FollowComment"

Answer: "0Hi larryq,I'll refer you to the doc. page that has most of what you need here: https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_TABLE_NEW.htmlIf the PostgreSQL DB is the true source for this data then I recommend the following:BIGSERIAL -> BIGINT as they are both INT8.  If you source the rows from PostgreSQL you don't need the auto generating value creation of BIGSERIAL in Redshift.  Otherwise Redshift has the IDENTITY column attribute to generate values.JSON -> VARCHAR.  Of course you'll have to use Redshift's JSON function to do anything with the JSON data.Regards,-KurtCommentShareklarsonanswered 3 years ago0Thanks Kurt, much appreciated.CommentSharelarryqanswered 3 years ago"


Question: Airflow dropping connections to metadatabase

"Hello!We have that error every day, sometimes more often, sometimes less.The task gets stuck for 15 minutes in the status queue, then it starts to run and we get an error in the logs.I know that very similar to https://forums.aws.amazon.com/message.jspa?messageID=975621HaveClass  = mw1.mediumScheduler count = 2Maximum worker count = 10Minimum worker count = 2And set upcelery.sync_parallelism = 1celery.worker_autoscale = 5,5[2022-03-29 13:03:35,118: WARNING/ForkPoolWorker-4] Failed operation _store_result. Retrying 2 more times.Traceback (most recent call last):File "/usr/local/lib64/python3.7/site-packages/sqlalchemy/engine/base.py", line 1277, in _execute_contextcursor, statement, parameters, contextFile "/usr/local/lib64/python3.7/site-packages/sqlalchemy/engine/default.py", line 608, in do_executecursor.execute(statement, parameters)psycopg2.DatabaseError: could not receive data from server: Connection timed outThe above exception was the direct cause of the following exception:Traceback (most recent call last):File "/usr/local/lib/python3.7/site-packages/celery/backends/database/__init__.py", line 47, in _innerreturn fun(*args, **kwargs)File "/usr/local/lib/python3.7/site-packages/celery/backends/database/__init__.py", line 117, in _store_resulttask = list(session.query(self.task_cls).filter(self.task_cls.task_id == task_id))File "/usr/local/lib64/python3.7/site-packages/sqlalchemy/orm/query.py", line 3535, in __iter__return self._execute_and_instances(context)File "/usr/local/lib64/python3.7/site-packages/sqlalchemy/orm/query.py", line 3560, in _execute_and_instancesresult = conn.execute(querycontext.statement, self._params)File "/usr/local/lib64/python3.7/site-packages/sqlalchemy/engine/base.py", line 1011, in executereturn meth(self, multiparams, params)File "/usr/local/lib64/python3.7/site-packages/sqlalchemy/sql/elements.py", line 298, in _execute_on_connectionreturn connection._execute_clauseelement(self, multiparams, params)File "/usr/local/lib64/python3.7/site-packages/sqlalchemy/engine/base.py", line 1130, in _execute_clauseelementdistilled_params,File "/usr/local/lib64/python3.7/site-packages/sqlalchemy/engine/base.py", line 1317, in _execute_contexte, statement, parameters, cursor, contextFile "/usr/local/lib64/python3.7/site-packages/sqlalchemy/engine/base.py", line 1511, in _handle_dbapi_exceptionsqlalchemy_exception, with_traceback=exc_info[2], from_=eFile "/usr/local/lib64/python3.7/site-packages/sqlalchemy/util/compat.py", line 182, in raise_raise exceptionFile "/usr/local/lib64/python3.7/site-packages/sqlalchemy/engine/base.py", line 1277, in _execute_contextcursor, statement, parameters, contextFile "/usr/local/lib64/python3.7/site-packages/sqlalchemy/engine/default.py", line 608, in do_executecursor.execute(statement, parameters)sqlalchemy.exc.DatabaseError: (psycopg2.DatabaseError) could not receive data from server: Connection timed out[SQL: SELECT celery_taskmeta.id AS celery_taskmeta_id, celery_taskmeta.task_id AS celery_taskmeta_task_id, celery_taskmeta.status AS celery_taskmeta_status, celery_taskmeta.result AS celery_taskmeta_result, celery_taskmeta.date_done AS celery_taskmeta_date_done, celery_taskmeta.traceback AS celery_taskmeta_tracebackFROM celery_taskmetaWHERE celery_taskmeta.task_id = %(task_id_1)s][parameters: {'task_id_1': '3a54bc75-847d-4538-9ddd-1615ca10ab82'}](Background on this error at: http://sqlalche.me/e/13/4xp6)[2022-03-29 13:03:35,140: INFO/ForkPoolWorker-4] Executing command in Celery: ['airflow', 'tasks', 'run', 'load_mc_data_to_dwh', 'check_mc_files', 'manual__2022-03-29T08:00:00+00:00', '--local', '--subdir', 'DAGS_FOLDER/load_mc_to_dwh.py'][2022-03-29 13:03:35,140: INFO/ForkPoolWorker-4] Celery task ID: 3a54bc75-847d-4538-9ddd-1615ca10ab82[2022-03-29 13:03:35,160: INFO/ForkPoolWorker-4] Filling up the DagBag from /usr/local/airflow/dags/load_mc_to_dwh.py[2022-03-29 13:03:35,387: WARNING/ForkPoolWorker-4] Running <TaskInstance: load_mc_data_to_dwh.check_mc_files manual__2022-03-29T08:00:00+00:00 [queued]> on host ip-10-0-1-129.eu-west-2.compute.internal[2022-03-29 13:03:37,115: INFO/ForkPoolWorker-4] Task airflow.executors.celery_executor.execute_command[3a54bc75-847d-4538-9ddd-1615ca10ab82] succeeded in 940.2485898699997s: NoneThanks,MarkoFollowComment"

Answer: "2Accepted AnswerThe key is setting celery.pool equal to soloHere's our full config:celery.poolsolocelery.sync_parallelism1celery.worker_autoscale1,1core.dag_file_processor_timeout150core.dagbag_import_timeout90core.killed_task_cleanup_time604800core.min_serialized_dag_update_interval60scheduler.dag_dir_list_interval300scheduler.min_file_process_interval300scheduler.parsing_processes2scheduler.processor_poll_interval60scheduler.schedule_after_task_executionfalseCommentShareknowsuchagencyanswered a year agoAWS-User-5132740 a year agohello. Thanks you very much, seems like works. I will write here in few days if everything ok.Share1Setting celery.pool  equal to solo also worked for me. However, my DAGs runs for a longer time when celery.pool is set to solo since it doesn't use multiprocessing. I would like to use the default celery.pool setting of prefork.I am noticing this issue on both Airflow 2.2.2 and 2.0.2.Please have this bug resolved for us.CommentSharekayelvoanswered a year ago0Hello,From the error stack trace I see connection timed out issues for the PostGres connectionFile "/usr/local/lib64/python3.7/site-packages/sqlalchemy/engine/default.py", line 608, in do_executecursor.execute(statement, parameters)sqlalchemy.exc.DatabaseError: (psycopg2.DatabaseError) could not receive data from server: Connection timed out--> But, since you also mentioned that the tasks get stuck for 15 min in status queue and will start running later, I would request for more information from your MWAA environment if it's running multiple DAGs ?--> I see that the configuration you currently have for celery.worker_autoscale = 5,5, can you please confirm if you are facing the same issue even if the property is set to celery.worker_autoscale = 1,1 ?This issue needs deeper troubleshooting. I would recommend you to please open a support ticket with MWAA support providing the environment ARN and the time stamp when you faced this issue and we can assist you over screen-share.REFERENCES:https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-autoscaling.html#mwaa-autoscaling-high-volumeCommentShareSUPPORT ENGINEERVishali_Nanswered a year agoAWS-User-5132740 a year agoHi, thank you very match for the replay.Yes with celery.worker_autoscale = 1,1 issue still there.more information from your MWAA environment if it's running multiple DAGsYes, we run a few DAGs, even though we have a DAG that runs another DAGs. But this issue faced us when we had run only one simple DAG.Share0We have the same scenario as Kayelvo.  We set celery.pool to solo, which "fixed" the 15/30 min queuing (task delay) issue with the associated timeout errors connecting to the metadata database.  However, as soon as we run a few DAGs with a handful of tasks running in parallel, we start seeing tasks delayed.  Thus we would also like the root cause of the connection issues resolved so that we can use the default prefork setting.  We cannot current set up a truly functional new environment at this time due to this issue (both version 2.0 and 2.2).CommentSharePamCanswered a year agoAWS-User-5132740 a year agowe start seeing tasks delayedHi, looks like its time to up the new worker.Share0Can confirm celery.pool of "solo" worked in our case as well. One thing I thought I'd add for anyone stumbling across this in the future - there is an Airflow community slack here: https://apache-airflow-slack.herokuapp.com/ that has an AWS channel for anything MWAA related - looking back through recent posts in there, it has problem reports for all of the issues (and suggested workarounds, including this one) that we have experienced with our MWAA 2.2.2 upgrade...wish we had found it earlier!CommentShareMWFamiliarisanswered a year ago"


Question: gdk init failing with ssl verification error

"Hi ,I am hitting an ssl verification error when trying to run gdk init command to create a greengrass component in my local IDE.I am behind an enterprise firewall and I dont think setting ssl verification to false has worked either.Please advice.FollowComment"


Question: Mass Import of Users to Cognito User Pool

"A customer is planning to migrate their existing 5.4 million user base to Cognito(using doorkeeper gem for authentication currently) and would like their current users to be able to retain their existing passwords.Is there a way to do a batch user import and retain all existing passwords?- I found the following blog post on this, would they need to follow the one-at-a-time user migration process or is there a better way? (https://aws.amazon.com/blogs/mobile/migrating-users-to-amazon-cognito-user-pools/)How long would a migration like this take (reasonable timeline?)/ how long would it require both authentication systems to be up and running?What happens to any duplicate user info during the migration over to Cognito?The customer was also curious if at any point they needed to move their user pool out, is there a process to export their user pool?Thank you so much!FollowComment"

Answer: "0Accepted AnswerIn addition to what is described in the blog, Cognito added support for a Migration Lambda trigger that allows an easier setup for a one-by-one migration, basically replacing the "migration microservice" described in the blog.This is the only way to retain passwords transparently for the user, as the user will not know the backing IdP has changed. This process will take some time to execute as it requires that each user logs in at least once, and it is important that the implementation follows the advices given in our documentation in regard to which auth flow to use.This is up to the customer to decide, and depends on when the users log in the first time. The customer can decide on a given threshold (eg 70% of user migrated) before shutting down his existing auth. This would mean that the remaining users will have to use the forgotten password flow to set the password in the new system (explained in the doc above)If the user already exists in Cognito, the migration lambda is not called and the user logs in directly into CognitoThe customer can export the content of the pool using the ListUser API. Cognito does not stores the user passwords in recoverable format hence they cannot be exported. A process similar to the one used to migrate into Cognito can be also used to migrate user out of CognitoCommentShareEXPERTMassimilianoAWSanswered 3 years ago"


Question: How to SigV4 sign a request from API Gateway to AppSync using an HTTPIntegration?

"I needed to set up cross account access to AppSync, from account A to account B. I'm using CDK for infra. Since AppSync doesn't support resource based policies, I created an instance of API gateway in account B, and setup a aws service integration (AwsIntegration) from the API Gateway to AppSync in that account; Then I set up a resource based policy on the API gateway in account B that allows requests from services in account A, which then get proxied to AppSync in account B. I got the approach from here.Instead of using a aws service integration, I'd like to use the HttpIntegration. The HttpIntegration, however, doesn't seem to create the needed Authorization header to access AppSync. I keep getting 401 error when I try to test. Is the credentialsRole on the construct just being ignored? Or am I missing something?ThanksFollowComment"

Answer: "0With HttpIntegration, the request is sent as normal web request, so you'll need to include sig v4 as described here - https://docs.aws.amazon.com/general/latest/gr/create-signed-request.htmlIf you are trying to proxy the request from API Gateway in account B, then the identity that's initiating the request must have access to the resource you're accessing and then generate the signature accordingly.CommentShareVaibhav Janswered 2 months ago"


Question: Restoring snapshot with Multi-AZ flag to NO leads to Multi-AZ flag to YES

"Hello!I recently found 3 RDS instances of mine with unexpected Multi-AZ flag set to YES even if I left Multi-AZ flag NO (is the default!) when I created them from snapshot restoring, using AWS console.Does anyone get the same issue?I already contacted AWS support and they're investigating - they also told me that using CLI or "Restore to point in time" is ok instead.FollowComment"

Answer: "0Dear AWS Customer,When you restore a snapshot to a new RDS instance, then you get a radio button option to select "Multi-AZ" deployment option, the instance is then restored accordingly and this is an ideal behaviour.I can confirm that it is a known bug in the RDS console and currently being investigated internally. Currently, we don't have an ETA on it. The workaround is to utilize the AWS CLI in the meantime for restoring.I apologise for the inconvenience caused due to this issue.I hope above information helps.  However, if you have any questions or concerns related to this issue please keep an eye out on your support case.References:Restoring from a snapshot:[+]https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_RestoreFromSnapshot.html#USER_RestoreFromSnapshot.RestoringCommentShareSUPPORT ENGINEERShubhra_Sanswered 7 months ago"


Question: Cloud9: How To Remove "Add Debug Configuration" which has been injected at the top of all my functions

"HI, I have been using Cloud9 for a long time, since well before it was acquired by AWS.A few days ago, in all of my Cloud9 Editor windows, the following non-editable text has been injected at the top of all functions in Python and Javascript:This is pretty distracting, and I can't figure out how to turn it off. Does anyone know how to remove it?thanksFollowComment"

Answer: 0Hi! Thanks for reporting this. It appears to be a bug on Cloud9 side and the team is working on resolving this. We'll keep this thread updated.If you want to disable this you can go to Preferences -> AWS Settings -> AWS Toolkit and switch off the toggle and reload the IDE.CommentShareanester-awsanswered a year ago0The fix has been deployed in Cloud9 and you should not see this added text in Javascript / Python code.CommentShareanester-awsanswered 10 months ago


Question: S3 Object Redirect not working?

"Hello, I am trying to add a metadata redirect onto some pdf objects which have been superseded in the past.I have set the value of the "x-amz-website-redirect-location" key to the correct object key but no luck, the object url still opens the original pdf.Have tried in a private browser as to avoid any cache issues.Any help appreciated.FollowComment"

Answer: 2Accepted AnswerThat redirection only works if you have enabled the Statis Website hosting and you are accessing the objects via the Statisc website endpoint. If you are accessing it directly on the S3 bucket URL or S3 API the redirection will not work.CommentShareEXPERTToni_Sanswered a month ago


Question: AWS Inspector2/Enhanced Scanning Uses Image Tags to Detect OS

"Hi,I am currently trialing Enhanced Scanning with our ECR repos. What I have identified is, it seems Inspector2 is inferring some information from tags, and using that to detect the OS.For example, see this screenshot -> https://imgur.com/a/VBDNSqL. I have uploaded a container with base image of Oracle Linux 8, with the tag "latest5". ECR is taking the "5" as the OS version, and treating this container as Oracle Linux 5.You can see in the screenshot also, the CVE's report, and the OS they affect are RHEL 5/6.I am trying to understand if this is expected behavior or a bug in ECR?Cheers!FollowComment"


Question: How AWS EKS is able to create an EC2 Auto Scaling Group if that action isn't allowed by the attached role?

"When creating EKS cluster I attached a role to EKS which was required. The role I created using official documentation. To that role only AmazonEKSClusterPolicy policy is attached through which I guess creating EC2 Auto Scaling Group(action: CreateAutoScalingGroup) is not allowed, but still EKS is able to create EC2 Auto Scaling Group when I create Node Group.Question: So how EKS is able to create an EC2 Auto Scaling Group if the role doesn't allow it?JSON settings of AmazonEKSClusterPolicy policy:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "autoscaling:DescribeAutoScalingGroups",                "autoscaling:UpdateAutoScalingGroup",                "ec2:AttachVolume",                "ec2:AuthorizeSecurityGroupIngress",                "ec2:CreateRoute",                "ec2:CreateSecurityGroup",                "ec2:CreateTags",                "ec2:CreateVolume",                "ec2:DeleteRoute",                "ec2:DeleteSecurityGroup",                "ec2:DeleteVolume",                "ec2:DescribeInstances",                "ec2:DescribeRouteTables",                "ec2:DescribeSecurityGroups",                "ec2:DescribeSubnets",                "ec2:DescribeVolumes",                "ec2:DescribeVolumesModifications",                "ec2:DescribeVpcs",                "ec2:DescribeDhcpOptions",                "ec2:DescribeNetworkInterfaces",                "ec2:DetachVolume",                "ec2:ModifyInstanceAttribute",                "ec2:ModifyVolume",                "ec2:RevokeSecurityGroupIngress",                "ec2:DescribeAccountAttributes",                "ec2:DescribeAddresses",                "ec2:DescribeInternetGateways",                "elasticloadbalancing:AddTags",                "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",                "elasticloadbalancing:AttachLoadBalancerToSubnets",                "elasticloadbalancing:ConfigureHealthCheck",                "elasticloadbalancing:CreateListener",                "elasticloadbalancing:CreateLoadBalancer",                "elasticloadbalancing:CreateLoadBalancerListeners",                "elasticloadbalancing:CreateLoadBalancerPolicy",                "elasticloadbalancing:CreateTargetGroup",                "elasticloadbalancing:DeleteListener",                "elasticloadbalancing:DeleteLoadBalancer",                "elasticloadbalancing:DeleteLoadBalancerListeners",                "elasticloadbalancing:DeleteTargetGroup",                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",                "elasticloadbalancing:DeregisterTargets",                "elasticloadbalancing:DescribeListeners",                "elasticloadbalancing:DescribeLoadBalancerAttributes",                "elasticloadbalancing:DescribeLoadBalancerPolicies",                "elasticloadbalancing:DescribeLoadBalancers",                "elasticloadbalancing:DescribeTargetGroupAttributes",                "elasticloadbalancing:DescribeTargetGroups",                "elasticloadbalancing:DescribeTargetHealth",                "elasticloadbalancing:DetachLoadBalancerFromSubnets",                "elasticloadbalancing:ModifyListener",                "elasticloadbalancing:ModifyLoadBalancerAttributes",                "elasticloadbalancing:ModifyTargetGroup",                "elasticloadbalancing:ModifyTargetGroupAttributes",                "elasticloadbalancing:RegisterInstancesWithLoadBalancer",                "elasticloadbalancing:RegisterTargets",                "elasticloadbalancing:SetLoadBalancerPoliciesForBackendServer",                "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",                "kms:DescribeKey"            ],            "Resource": "*"        },        {            "Effect": "Allow",            "Action": "iam:CreateServiceLinkedRole",            "Resource": "*",            "Condition": {                "StringEquals": {                    "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"                }            }        }    ]}FollowComment"

Answer: 2The Managed Node Group creation uses your permissions when it creates the Auto Scale Group. The EKS Cluster role is then used by the EKS cluster control plane to monitor that managed node group and adjust the desired instance count based on the cluster autoscaler requirements..CommentShareEXPERTToni_Sanswered 9 months ago


Question: Profiling memory for a NodeJS Lambda function

"Is there any tool, solution, framework, service or alike to allow memory profiling for  NodeJS based lambda functions? Maybe even running on AWS directly and not on a local development environment? What would be the recommendation for such kind of profiling?I'm aware that local profiling can be done using Chrome's Inspect / DevTools, but that actually means debugging a "long running process", not a short-lived one like a lambda function.Additional Context:We migrated a reporting service from an EC2 instance to a ECS Fargate based docker container using a basic lift & shift approach, but with the catch that we assigned less memory to the ECS Task than the original configuration of the EC2 instance purposely, as usually the instance had quite a lot of unused resources. So, now we are transitioning the "outliers" that fail with OutOfMemoryError into lambdas, but we'd like to improve their code and not just move them to a lambda container.FollowCommentJeff Strunk a year agoWhat is your goal for using a memory profiler? Are you running out of memory in some invocations? Are you trying to optimize memory usage to optimize the cost of Lambda? What details are you trying to capture that are missing from the the Lambda invocation logs that show the total memory used?Share"

Answer: "0Also searching for the best solution to create a heap snapshot from AWS Lambda written in NodeJS. Tried to call V8 heap utilities. Statistics works but as soon as I want to get a dump, it hangs:  // THIS WORKS.  console.log("Heap space stats = ", v8.getHeapSpaceStatistics())  console.log("Heap code stats heapdump = ", v8.getHeapCodeStatistics())  console.log("Heap stats = ", v8.getHeapStatistics())  // THIS HANGS.  console.log("Getting heapdump...")  const snapshotStream = v8.getHeapSnapshot()Any idea why? Is this even possible in the context of AWS Lambda? Any alternative - I'd really like to get memory details, not just stats?CommentShareSpianswered a year agovivien-de-saint-pern a year agoTrying to reproduce with (almost) same code and I got it working. Instead of using getHeapSnapshot, I wrote it to a tmp file before sending to S3. Can you check this repo and tell me what's different in your code ? https://github.com/vdesaintpern/lambda-heap-dump-to-s3-v8You can also check Lambda PowerTools for Typescript which can probably help you for tracing. https://awslabs.github.io/aws-lambda-powertools-typescript/latest/core/tracer/Share0Jeff's questions are good. We may be able to provide more suggestions if you can answer those. In the meantime, one easy way to get basic insight into memory usage in a NodeJS script is to use the process.memoryUsage() method. This article provides a nice overview with examples.CommentShareKrisanswered a year ago"


Question: Amazon Cognito Ec2 connection

"Hi Guys,I deployed my java app on EC2 and here I am doing call to Amazon Cognito in order to push user data. So I am getting below error,Profile file contained no credentials for profile 'default': ProfileFile(profiles=[])". When you are trying the same on your local machine its working fineMy understanding was If I gave IAM role(CognitoSuperUser) which has permission for Cognito to Ec2, I don't have to put credentials in EC2 profile file. Am I wrong?will not EC2 be able to allow calling to Cognito without any configuration? Like I do call to S3 from Ec2 by allowing permission in the IAM role that assigned Ec2.This is the way I create client to call. is there any other way to make call instead of ProfileCredentialsProviderthis.cognitoClient = CognitoIdentityProviderClient.builder()                .region(Region.US_EAST_2)                .credentialsProvider(ProfileCredentialsProvider.create())                .build();ThanksFollowComment"

Answer: "0Hi,Could you these options?do not provide any credentials provider in build method chain oruse https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/auth/AWSCredentialsProvider.html orhttps://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/auth/DefaultAWSCredentialsProviderChain.htmlHope it helps ;)CommentShareEXPERTalatechanswered 2 months ago"


Question: CNAME and TXT type for same record.

"For hosted zone name: example.com, under RecordSets I want to add xyz.example.com. I want it to be of type TXT and CNAME with different ResourceRecord values for each type.How can I achieve this?FollowComment"

Answer: "0For hosted zone name: example.com, under RecordSets I want to add xyz.example.com. I want it to be of type TXT and CNAME with different ResourceRecord values for each type.How can I achieve this?This is forbidden in DNS so Route 53 does not allow it.   You may create either a CNAME (only) or a combination of any other record type at a single domain.https://datatracker.ietf.org/doc/html/rfc1912#section-2.4The way to think about CNAME records in DNS is as a sort of redirect or symlink "All record types for $DOMAIN are located at $OTHER_DOMAIN".   For that reason, if you create a CNAME, you cannot also create a TXT record, but you can and likely should create the the TXT record at the domain to which the CNAME refers.CommentShareEXPERTgavinmcanswered 2 years ago"


Question: Chrome Google profile automaticaly logout on EC2 LightSail Windows server 2022

"I'm using Google Chrome in my EC2 LightSail and Sign in with my Google account, it is still normal when I was remoting. But when I stop my remote session and go back after some hours, my Google account is logged out. It is shown like that I tried to search the issue in Google and tried to config in gpedit.msc to change the session time, but the issue is not solved. Do you have any idea with it? Please help me to figure out. Thanks!FollowComment"


Question: Question about ECS Fargate

"I am trying to deploy my.net core service in a container on AWS ECS, and I want to imply when this service start it will register in my consul server and execute health check, but I can only get my host ip after it is deployed, I can not pass the right host ip address to consul server so that I can not execute health check, is there any way to get host ip from container?FollowComment"

Answer: "0Accepted AnswerIm guessing you get the container ip and not the host it’s running on?Is this similar to https://groups.google.com/g/nomad-tool/c/S-MS5sbmzJ0?pli=1If not you will never get the host IP untilIt’s deployed is it will be deployed in a cluster.CommentShareGary Mcleananswered 18 days agoChao 14 days agoSorry for the late reply, I just find a way to solve this. By using Dns.GetHostEntry(Dns.GetHostName()).AddressList.First(), it can easily get the private IP address of server. At first, I use toString() rather than first().but finally it works. Thank you Again.!!Share0Hello,Do you have all the prerequisites that Consul requires?https://developer.hashicorp.com/consul/docs/ecs/requirementsCommentShareAWS-ADolganovanswered 15 days agoChao 14 days agoYes, Finally solved problem, thanks your timeShare"


Question: "Simple(?) question regarding Lambda, EC2 and user data"

"Hi all:I've been digging for a while for some best practices for what I'm trying to do. I have an S3 bucket, and when an object gets added to the bucket, I want to have Lambda launch an EC2 instance. This is very straightforward, but I also want to obtain the S3 key name for the object in the user data of the new EC2 instance.Is there a way to do this, or is the apparent absence of any documentation or best practices for this kind of scheme an indication that it's a bad architecture?Thank you,FollowComment"

Answer: 0Use the UserData argument to the boto3 ec2.run_instances method.CommentSharetechn0madanswered 3 years ago


Question: How do I get a Cloudwatch bar chart to group by period?

Making line charts and stacked area charts for a single metric using Sum with a Period of 7 Days. But when I change the graph type to Bar it just sums all the data into a single bar with no regard to the chosen period. How do I make a bar chart that works as expected?Stacked area: https://paste.pics/FW0V0Bar: https://paste.pics/FW0V7FollowComment

Answer: "0Hi, and thank you for reaching out!Currently, bar charts graphed in CloudWatch Metrics cannot display data over time broken up by the specified period. The Bar chart option is intended to graph data categorically as opposed to chronologically. As a result, specifying the Bar chart option for a metric will aggregate all the data within the specified time range in to a single bar per metric. In order to view metric data as a time-ordered graph, you will need to use the Line or Stacked Area options at this time.I can confirm that there is an open feature request to allow for a time ordered histogram when graphing metrics. While I am unable to comment on if/when this feature may get released, you can keep an eye on our What's New and Blog pages for any new feature announcements!CommentShareSUPPORT ENGINEERJustin_Banswered a year ago"


Question: How long can you continue to use SMS sandbox for SNS?

"So I am a developer learning to send automated SMSs via SNS. Obviously, I have no need to try and move out of sandbox for now, but I feel like there should be a time limit to using it. Something like "You can send SMSs to verified phone numbers for 6 months from sandbox. After this, you either contact support to move out of sandbox, or you cannot send SMSs anymore." I haven't found anything like this written anywhere yet, but I feel like no time limit would be too good to be true. Can someone please verify?FollowComment"

Answer: "1Accepted AnswerThe sandbox is only to prevent people from spamming phones with messages. If you get out of the sandbox and would start spamming, AWS will put your account back into the sandbox.The documentation says:You can send a maximum of 20 SMS messages per second.You can send SMS messages to a maximum of 10 verified destination phone numbers.https://aws.amazon.com/blogs/compute/introducing-the-sms-sandbox-for-amazon-sns/I think these conditions are 'forever'.You still have to pay for the SMS's sent. The free tier is only for US numbers:From the faqs (https://aws.amazon.com/sns/faqs/)Q: Is there an AWS Free Tier allowance for sending SMS messages?Yes—the first 100 SMS messages you send to destinations in the United States each month are included in the AWS Free Tier. This allowance doesn't expire. Note that a "message" in this sense refers to a single transmission that contains 140 bytes of information or less, as explained in the answer to the previous question.If you send more than 100 messages to destinations in the United States, or if you send messages to destinations outside the United States, each message you send is charged based on our current pricing rates. You can find the latest rates on the SMS Pricing page.CommentShareJaccoPKanswered a year agoautomation a year agoThank you for answering my question so quickly. And just to verify another thing, the first 100 SMSs per month are free right? Even in sandbox?ShareJaccoPK a year agoI guess only to US numbers:https://aws.amazon.com/sns/faqs/Q: Is there an AWS Free Tier allowance for sending SMS messages?Yes—the first 100 SMS messages you send to destinations in the United States each month are included in the AWS Free Tier. This allowance doesn't expire. Note that a "message" in this sense refers to a single transmission that contains 140 bytes of information or less, as explained in the answer to the previous question.If you send more than 100 messages to destinations in the United States, or if you send messages to destinations outside the United States, each message you send is charged based on our current pricing rates. You can find the latest rates on the SMS Pricing page.Shareautomation a year ago@JaccoPK thanks. I felt like my research was incomplete or I was missing something, so it feels good to get a second verification.Share"


Question: How to access RDS running hours using boto3

"Hi Team,I want to extract the running hours of RDS instances from past 6 months. I used the get_cost_and_usage API and filters as follows:    Filter={            'And':[{            'Dimensions':{                'Key':'SERVICE',                'Values':['Amazon Relational Database Service']            }},            {                'Dimensions':{                'Key':'USAGE_TYPE_GROUP',                'Values':['RDS: Running Hours']            }            }                           ]               }It does brings the RDS cost, but brings no output for 'DimensionValueAttributes': [].Please assists.Regards,Nikhil ShahFollowComment"

Answer: "0Accepted AnswerHey Guys.. I found the answer...I was missing the Metrics type, I just included 'AmortizedCost' hence it was showing only cost and not the usage. So Added both 'UsageQuantity' & 'AmortizedCost', now get both usage and cost associated with RDS.Filter={'And':[{'Dimensions':{'Key':'SERVICE','Values':['Amazon Relational Database Service']}},{'Dimensions':{'Key':'USAGE_TYPE_GROUP','Values':['RDS: Running Hours']}}]}CommentShareAWS-User-1576695answered a year ago"


Question: IAM as code - centralize the management of IAM roles and policies in a multi-account organization

"A customer is trying to centralize the management of IAM roles and policies in a multi-account organization. They would like to achieve the following:keep log of all changes for compliance reasonsfacilitate periodical audits processtest policies in sandbox environment before deploying in productionThey are using Terraform and would like to use CodeCommit as repository.Do we have examples of customers who have achieved such a process, and/or best practices?ThanksFollowComment"

Answer: 0Accepted AnswerYou should check out the blog post on best practices with OU management. There are suggestions for both sandbox environments and logging:https://aws.amazon.com/blogs/mt/best-practices-for-organizational-units-with-aws-organizations/Check out centralized CloudTrail for logging and auditing. It's a widely adopted best practice. It helps the management account make sure everything is logged (and doesn't let member accounts turn it off).For IAM role usage. There are many approaches customers can take. I don't have Terraform examples. Stacksets provides easy integration for rollout of IAM roles.CommentShareAWS-User-4197455answered 3 years ago


Question: Unable to access Secrets in Secret Manager from inside docker service in Greengrass V2

"I have been following this doc for creating a connection between my docker service running on my device with secret manager in my AWS account and retrieve the secret in my service.My component name is PnP and my configuration looks like :-{  "accessControl": {    "aws.greengrass.SecretManager": {      "PnP:secrets:1": {        "policyDescription": "Allows access to a secret.",        "operations": [          "aws.greengrass#GetSecretValue"        ],        "resources": [          "*"        ]      }    },    "aws.greengrass.ipc.pubsub": {      "PnP:pubsub:1": {        "policyDescription": "Allows access to publish to input topics.",        "operations": [          "aws.greengrass#PublishToTopic"        ],        "resources": [          "cloudwatch/metric/put"        ]      }    },    "aws.greengrass.ipc.mqttproxy": {      "PnP:pubsub:2": {        "policyDescription": "Allows access to subscribe to input topics.",        "operations": [          "aws.greengrass#SubscribeToIoTCore"        ],        "resources": [          "*"        ]      }    }  }}aws.greengrass.SecretManager configuration is:-{  "reset": [],  "merge": {    "cloudSecrets": [      {        "arn": "arn:aws:secretsmanager:us-east-1:#####:secret:secretName"      },      {        "arn": "arn:aws:secretsmanager:us-east-1:#####:secret:secretName2"      }    ]  }}Also, i have added the permission for Secret in my role:{            "Effect": "Allow",            "Action": [                "secretsmanager:GetSecretValue"            ],            "Resource": [                "arn:aws:secretsmanager:us-east-1:####:secret:secretName",                "arn:aws:secretsmanager:us-east-1:####:secret:secretName2"            ]}Now, i am accessing the same in my java docker container using :-final GreengrassCoreIPCClient client = new GreengrassCoreIPCClient(connection);log.info("Client: {}", client);final GetSecretValueRequest getSecretValueRequest = new GetSecretValueRequest();getSecretValueRequest.setSecretId(secretArn);getSecretValueRequest.setVersionStage("AWSCURRENT");final GetSecretValueResponseHandler responseHandler = client.getSecretValue(getSecretValueRequest, Optional.empty());final CompletableFuture<GetSecretValueResponse> responseFuture = responseHandler.getResponse();try {      GetSecretValueResponse response = responseFuture.get(TIMEOUT_SECONDS, TimeUnit.SECONDS);      response.getSecretValue().postFromJson();      return response.getSecretValue().getSecretString();} catch (TimeoutException e) {       log.error("Timeout Error fetching secret key ", e);} catch (ExecutionException e) {       if (e.getCause() instanceof UnauthorizedError) {              log.error("UnAuthorized Error fetching secret key ", e);       } else {             log.error("Authorized Error fetching secret key ", e);      }}Now, i am getting exception at this lineresponseFuture.get(TIMEOUT_SECONDS, TimeUnit.SECONDS)in my container service my logs are:13:34:40.462 INFO  - Client: software.amazon.awssdk.aws.greengrass.GreengrassCoreIPCClient@196b8ae13:34:40.483 INFO  - ResponseHandler: java.util.concurrent.CompletableFuture@2e523e58[Completed exceptionally: java.util.concurrent.CompletionException: software.amazon.awssdk.aws.greengrass.model.ResourceNotFoundError]13:34:40.484 ERROR - Authorized Error fetching secret key java.util.concurrent.ExecutionException: software.amazon.awssdk.aws.greengrass.model.ResourceNotFoundErrorat java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:395) ~[?:?]at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:2022) ~[?:?]at com.amazon.spiderIoT.scanner.secret.SecretManagerImpl.getSecretKey(SecretManagerImpl.java:39) ~[SpiderScannerService-1.0.jar:?]and greengrass.log looks like :-2022-07-06T14:19:49.471Z [ERROR] (Thread-4) com.aws.greengrass.secretmanager.SecretManagerService: secret-access. Error happened with secret access. {secret=arn:aws:secretsmanager:us-east-1:####:secret:secretName, serviceName=aws.greengrass.SecretManager, currentState=RUNNING, Principal=PnP}com.aws.greengrass.secretmanager.exception.v1.GetSecretException: Secret not found arn:aws:secretsmanager:us-east-1:##:secret:secretNameand i have verified using aws cli, and i am able to fetch the secret in console.FollowComment"

Answer: "0In order for a container to access secrets via the IPC, you need to pass in additional environment variables to your container (e.g., docker run...). Please review this documentation on accessing IPC via a container and see if that helps. The component lifecycle would look similar to this (focus on the Run command):     "Lifecycle": {        "Install": "docker load -i {artifacts:path}/publish-to-iot-core.tar",        "Run": "docker run -v $AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT:$AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT -e SVCUID -e AWS_GG_NUCLEUS_DOMAIN_SOCKET_FILEPATH_FOR_COMPONENT -e MQTT_TOPIC=\"{configuration:/topic}\" -e MQTT_MESSAGE=\"{configuration:/message}\" -e MQTT_QOS=\"{configuration:/qos}\" --rm publish-to-iot-core"      }Let me know if that helps! If if does, could you please +1 and accept the answer? If not, we'll get you sorted.CommentShareGavin_Aanswered a year ago"


Question: Png images getting corrupted while uploading to s3

Png images getting corrupted while uploading to s3. same upload flow works in case of jpg/jpeg/pdfSteps we are following to upload files on s3a. creating signed url (In which we are giving the location and document type)b. we are uploading the document on provided urlwe observe in case of png files size of the file getting increased.We are using amazon s3client (javaSDK) to upload the document which takes in signed url as the parameterFollowCommentDmitry Balabanov a year agoCould you please share a code snippet that shows how you upload the files? Thank you!Share

Answer: "0Hello,Could you please share a code snippet that shows how you upload the files?CommentShareSUPPORT ENGINEERAjinkya B-AWSanswered a year ago"


Question: IAM roles rightsizing

How should one be rightsizing IAM roles? Is there a tool i could use?FollowComment

Answer: "0Accepted AnswerHi, please take a look at IAM access analyser.It provides the following capabilities:helps identify resources in your organization and accounts that are shared with an external entity. This lets you identify unintended access to your resources and data.validates IAM policies against policy grammar and best practices.generates IAM policies based on access activity in your AWS CloudTrail logs. You can use the generated policy to refine an entity's permissions by attaching it to an IAM user or role.In addition, this blog talks through a solution that provides continuous profiling of IAM usage with automated adjustments of permissions using AWS Config and CloudKnox.CommentShareKashanswered a year agorePost-User-9123442 a year agoThanks for the quick response.Share0Hi,if by rightsizing, you mean a way to analyze and optimize IAM policies, you can look at IAM Access Analyzer ... https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.htmlIt generates findings based on best practices and CloudTrail logs, which lets you know if your policies are permissive, and enables you to fine-tune them.CommentShareTushar Aanswered a year ago"


Question: Sendy Error : SignatureDoesNotMatch

error is coming in my sendy panel even after i've changed access key in setting"Your Sendy installation is unable to get your SES quota from Amazon because the 'Amazon Web Services Credentials' set in Sendy's main Settings are incorrect. You probably did not copy and pasted your IAM credentials fully or properly into the settings. Please re-do Step 5.2 and 5.3 of the Get Started Guide carefully to resolve this error."FollowComment


Question: Polly Abbreviation Pronunciation

"Polly pronounces "can't" as "can" + "back slash".How can I get an abbreviation like 't to be pronounced properly?'OutputFormat' => 'mp3','Text' => "<speak><prosody rate='medium' volume='x-loud'>I can't do it</prosody></speak>",'TextType' => 'ssml','LanguageCode' => 'en-US','VoiceId' => "Joanna",FollowCommentKris 9 months agoPolly is able to handle contractions like "can't", so the problem is likely being introduced by something in your code. Can you tell us which SDK or command line tool you are using to call Polly (boto3? Javascript SDK? AWS CLI?)? Can you also provide an example of the actual code you're using which results in this unintended behavior?Share"

Answer: 0Can you check your character encoding is UTF-8? It sounds like polly may be picking up a forward slash escape character?CommentShareAlex_Kanswered 9 months ago


Question: ParallelCluster and AWS Batch

"I'm new to using ParallelCluster. Have it set up in an AWS VPC and running test jobs successfully using the traditional pcluster scheduler. Now I'm setting it up with the AWS Batch back-end. I added this to ~/.parallelcluster/config:[cluster awsbatch]base_os = alinuxscheduler = awsbatchvpc_settings = publickey_name = swt_kk...compute_instance_type = c5.xlarge[vpc public]master_subnet_id = subnet-049f...compute_subnet_id = subnet-049f...vpc_id = vpc-044b...Following instructions here:https://aws-parallelcluster.readthedocs.io/en/latest/tutorials/03_batch_mpi.htmlsource ~/envs/pcluster-virtualenv/bin/activatepcluster create awsbatch --cluster-template awsbatchthe cluster creates ok and I can see the master and compute nodes running in the EC2 console, but pcluster cannot see the compute node:(pcluster-virtualenv) [kk@ip-172-16-0-10 ~]$ pcluster instances awsbatchMasterServer         i-065da40163ecebe4a(pcluster-virtualenv) [kk@ip-172-16-0-10 ~]$ awsbhosts --cluster awsbatchec2InstanceId    instanceType    privateIpAddress    publicIpAddress    runningJobs---------------  --------------  ------------------  -----------------  -------------and if I start a test job it just sits in the queue.The master and compute subnets are the same and have an internet gateway attached. I see this comment in the tutorial page:# Replace with id of the subnet for the Compute nodes.# A NAT Gateway is required for MNP.Is a NAT Gateway still required if an Internet Gateway is already in place? Must the compute subnet be different from the master subnet?Any ideas on what might be going wrong? Ways to debug?Thanks,KimFollowComment"

Answer: "0An internet gateway is not sufficient, a NAT gateway is needed because the containers only get private ip addresses. Underneath, AWS Batch is using task networking, which you can read about here: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.htmlThe best way to setup the networking is to follow the guide: https://docs.aws.amazon.com/eks/latest/userguide/create-public-private-vpc.htmlThen take the public and private subnets that were created and specify them in your config:[vpc public-private]master_subnet_id = subnet-<public>compute_subnet_id = subnet-<private>FYI, single node jobs (jobs not submitted with the-Nflag) don't need a NAT gateway and should run on your existing setup.Edited by: aws-hpc-sean on Feb 20, 2019 3:33 PMCommentShareaws-hpc-seananswered 4 years ago0Great information, thanks. I'll work through it and report back.I swear that the initial "vpc public" setup wouldn't even run a simple one-node job, but maybe something else was wrong. Will definitely check it out.CommentSharekimyxanswered 4 years ago0Using the create-public-private-vpc tutorial got me up and running. Our previous VPC had been cobbled together over time -- it seemed to have all the right pieces but there were some differences in how the routing tables attached to the VPC. I could ssh to the master and compute EC2s but awsb tools couldn't see them.Thanks for your help,KimCommentSharekimyxanswered 4 years ago"


Question: AWS RDS Linked Server not working

"We have 2 MS SQL server instances:Instance 1: MS SQL Server Standard Edition - db.r5.largeInstance 2: MS SQL Server Web Edition- db.r5.largeBoth these instances are in the same VPC and they both configured for port 1433This is the script we used to create the linked server on instance 2:EXEC master .dbo.sp_addlinkedserver @server = N'IR_Gaming', @srvproduct= N'', @provider= N'SQLNCLI', @datasrc= N'[our domain name for instance 1]'goEXEC master .dbo.sp_addlinkedsrvlogin @rmtsrvname=N'IR_Gaming' ,@useself=N'False' ,@locallogin=NULL,@rmtuser =N'admin',@rmtpassword='*******'goWhen we "Test Connection" or try to query the linked server. We get the following errror:OLE DB provider "MSOLEDBSQL" for linked server "IR_Gaming" returned message "Login timeout expired".OLE DB provider "MSOLEDBSQL" for linked server "IR_Gaming" returned message "A network-related or instance-specific error has occurred while establishing a connection to SQL Server. Server is not found or not accessible. Check if instance name is correct and if SQL Server is configured to allow remote connections. For more information see SQL Server Books Online.".Msg 53, Level 16, State 1, Line 0Named Pipes Provider: Could not open a connection to SQL Server [53].FollowComment"

Answer: 0Accepted AnswerJust has to add rule in security groupCommentSharerePost-User-0222493answered 21 days ago


Question: Container runtime network not ready: NetworkReady=false reason:NetworkPluginNotReady message:docker: network plugin is not ready: cni config uninitialized ERROR

"Hi,I have this error when I am creating EKS 1.21 cluster via console: Container runtime network not ready: NetworkReady=false reason:NetworkPluginNotReady message:docker: network plugin is not ready: cni config uninitialized ERRORFollowComment"

Answer: "1Accepted AnswerHi,Refer to the KB article related to the resolutionhttps://aws.amazon.com/premiumsupport/knowledge-center/eks-cni-plugin-troubleshooting/If the Answer is helpful, please click Accept Answer and up-vote, so that it can help others in the community looking for help on similar topics.CommentSharelearn2skillsanswered 9 months ago"


Question: SSH To EC2 Instance Using Wsftp Pro

Hello I am new to EC2. I have created an instance and am trying to connect to the VM instance using WSFTP Pro https://www.ipswitch.com/ftp-client?cta=hphero.From what I understand Amazon only allows SSH access using a Key pair and does not allow password access.I have created a Key pair and downloaded the .pem file.  The problem is WSFTP Pro requires the the key file extension to be .pub.  I have tried renaming .pem to .pub but that did not work.Please advise on what I am doing incorrectly. Thank you.FollowComment

Answer: "0Here is the solution.ssh-keygen -y -f private_key1.pem > public_key1.pubSee https://gist.github.com/zircote/1243501Edited by: T101 on Mar 19, 2021 4:45 PMCommentShareT101answered 2 years ago"


Question: Greengrass Component Local Log Interval

"Hi,Does anyone know how frequently/when the local component logs are updated?  Is there a way to increase the logging frequency?  It seems sort of random i.e. when starting a component.Thanks!MikeFollowComment"

Answer: "2Accepted AnswerHi Mike,There is no "interval". Logs are written to disk immediately when whatever event is being logged happens. Maybe you should look at: https://docs.aws.amazon.com/greengrass/v2/developerguide/troubleshooting.html#python-component-no-log-output?CommentShareEXPERTMichaelDombrowski-AWSanswered 9 months agoEXPERTChris_Greviewed 9 months agoAWS-User-6540243 9 months agoThanks Mike that helped a lot!  Logs are coming in instantly now.Share"


Question: Getting error on AWS Athena while setting up Agent event data stream to S3 using AWS Glue

"Here is the error I am getting while loading partition to table and data is not getting push to table automatically but it is getting push to S3 Agent Event bucket.This query ran against the "akctrathenaquicksitereportdata" database, unless qualified by the query.Please help in fixing this issue.FollowCommentCHELSEA IP 10 months agoHi, are you able post the error you're encountering?Share"


Question: Issues in S3 Buckets in Ireland Region - missing TSval & TSecr on 3 way handshake

"Hello everyone,We are experiencing issues with some S3 Buckets in the Ireland Region. Sometimes in the 3-way handshake, the TSval & TSecr on the [SYN ACK] are not returned (RFC 1323). When this happens we see a huge drop in the bandwidth. In other cases, it works fine. We are trying to download files from Italy with a latency of 40ms. The drop in performance might be caused by the CCR2004 Mikrotik router that is delaying the ACKs that are discarded by the S3 bucket, thus leading to a reduction in the congestion window.Why some S3 buckets are not returning the TSval & TSecr? (we have found that at least the subnet 52.218.0.0/16 is affected by this behaviour)Anyone else has the same problem with this latency (40ms)?FollowComment"


Question: DynamoDB Stream filters comparing values in NewImage and OldImage

"I have a table MyTable with count (numeric) among its fields.I want my CountListener function to be triggered each time the value of count gets updated, for any item in the table.I've enabled the stream (New and old images) for the table and now I need to write a filter for the stream events in order to invoke CountListener all and only each time count changes.From the docs I see how to write a filter that compares the value of a field with a constant value: I wonder if I can compare the value of count in NewImage against the one in OldImage and trigger the lambda if and only if they're different.FollowComment"

Answer: "1Accepted AnswerIt is not possible to achieve your goal with Lambda event filtering at the time of writing this for two reasons:There is no "numeric not equal" operatorIt is not possible to compare two fields of the stream data with each other.CommentShareAslan Ganswered a year agocionzo a year agoThank you for your answer.So, since the code knows whether the "count" field is going to be written, I could add a new (perhaps boolean) field like "updatedCount" set to true when a value for "count" is being set.Then, the trigger could be activated by a filter like '{"dynamodb": {"NewImage": {"updatedCount": [true]}}}'.Does it make any sense to you? If not, what would you suggest?Share"


Question: Classes reference no longer populating in 1.10?

I'm no longer seeing any class reference expansion or search functionality in 1.10. I've tested this on two clean installs on different computers. Am I the only one? Any idea what the issue is?Follow

Answer: "0Accepted AnswerHi @REDACTEDUSERIs this happening for you in the lua editor?One possible cause is that your lua editor is not connecting to the editor for debugging, etc. Without this connection to the editor, non of the class references will be visible. When you open up the lua editor, there should be three 'buttons' in the top-middle of the screen. The button that says 'Target' needs to be set to 'Editor':REMOVEDUPLOADYou can set the target by simply clicking on the button and choosing 'Editor'. Once the target is set to 'Editor' and the 'Context' to 'Default', you should be able to see the classes again. If you can't set the Target to Editor, try reopening the Editor, or load it by running the project through Visual Studio. It should be accessible, but it may not be defaulted to Editor depending on your settings.Let me know if this helps!SharerePost-User-3342048answered 6 years ago0That got it, thanks!SharerePost-User-6682533answered 6 years ago0Your solution is not working for me.REMOVEDUPLOADSo i alread have tried the following steps:Re-open the lua editor.Open the lua editor as administrator.Launch the Sandbox editor from VS 2015, then open de lua editor.Nothing have worked, and the Editor Target not appears.SharerePost-User-6668193answered 6 years ago"


Question: AWS Cost Explorer Unblended cost does not match CUR report unblended cost

"Hello,We are noticing that the unblended cost in AWS cost explorer does not match the unblended cost in cost and usage report.There is variation of about ~1.6% between Cost Explorer and CUR (CUR is 1.6% higher).Any idea what is happening here ? and in what all cases this can happen ?We have made sure that no other filters are applied when we do this comparison.Timezone doesn't seem to be an issue as well.FollowCommentNik2 a year agoany one has any insight into this ?Share"

Answer: "1Hi Nik,Please check if you are using the correct field line_item_unblended_cost , not to be confused with pricing_public_on_demand_cost.Please refer to one of our self-paced labs which can be used as reference on creating views which is similar to what you are trying to achieve.https://wellarchitectedlabs.com/cost/200_labs/200_cloud_intelligence/cost-usage-report-dashboards/dashboards/code/1_view1/CommentShareMark Canswered a year ago"


Question: Problems sending emails from workmail

You are currently not allowed to send this e-mail. Please try again later.2022-10-04 11:49:40 : An error occurred while trying to deliver the mail to the following recipients:id@domain.ac.krTechnical report:Final-Recipient: rfc822; id@domain.ac.krAny suggestions on what can be going on here??FollowComment

Answer: "0Hi,The error suggest that you have breached the limits of mails you're allowed to send. This can mean you're sending to much email or there is a problem with your account and it was locked to prevent abuse. For sending to much mail, are you using the testing domain .awsapps.com?If your account is locked there should be information about that in your personal health dashboard.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 8 months ago"


Question: Where does outbound traffic exit the Amazon network?

"This seems like an obvious and dumb question, but I've searched documentation and forums and can't find it answered with certainty. Basically, how is egress traffic routed by Amazon? If you have an application on an EC2 server that makes an originating, outbound connection to a server on the internet, where does your stream exit the Amazon network? It seems like there's two different possibilities:it exits from an internet gateway in the region and zone where your server is located and then traverses the public internet ORit is routed through the Amazon network to the edge location closest to the destination server and exits there.Obviously there are advantages to 2. If 2 isn't the default route, is there a service that provides 2? Global Accelerator clearly does this for connections that originate on the internet and come in to the AWS network, but what if the connection originates on your server within the AWS network? It's not clear to me...FollowComment"

Answer: "1Accepted AnswerHi isumatv,It's very good question.Generally AWS tries to keep packet as long as we can with in AWS network and try to exit it closest to destination. But there are circumstances where we need to exit out of AWS network quickly, possible reason could be.More bandwidth availability on Local Exit ISP/ reduced latency/traffic manipulation during maintenances. But generally we try to keep traffic on AWS internal network (cold potato routing)as we have full visibility of Network path and AWS network is optimised for best performance but its not always the case.Doing a trace route from your EC2 to your destination will give you some clue.Regards,muhaAtAWSCommentShareAWS-User-2854866answered 3 years ago"


Question: Cognito Disable update of attribute Phone Number  from AWSCognitoIdentityProviderService.updateUserAttributes

"We have app where user can sign up using phone number which is implemented with Amplify SDK and AWS Cognito.Once user as signed up, we are not allowing user to update their phone number by themselvesFor  Sign Up Flow we are using Amplify(Auth.signUp and Auth.confirmSignUp)In one of the pen test findings, security team has informed that users are able to update phone number from Cognito API(cognito-idp.amazonaws.com-> AWSCognitoIdentityProviderService.UpdateUserAttributes) if they have access token .We have tried1)By removing phone number as writable attribute from the app client setting in Cognito. but when we did it, User Sign up was failing.2)By Custom message Lambda trigger on UpdateUserAttributes and send Error response if updating on phone_number, but even there is error response from lambda phone_number is updated and only message is not sent.Is there any way to block/disable updating the phone number attribute from user/API once the sign up as completed?FollowComment"

Answer: "0Solution 1: Use authorization code sign-in and store the access token in such a way that the user can't access it. The hosted UI offers no native capacity for updating user attributes, so you have to code for attribute updates for the user to have access. This isn't foolproof of course: with a client-side app there's no way you can 100% insulate the access token from the user.Solution 2: Set up two app clients, one that can write the phone_number attribute and one that can't. Users are global to a user pool, so you can sign users up at #1 and sign them in at #2.Solution 3: Set phone_number as an alias but not required. Capture the phone number to an immutable custom attribute on sign-up (you can write immutable custom attributes once on sign-up). Use a pre sign-up Lambda trigger to write the custom attribute value to the phone_number attribute.CommentShareAWS-Brandonanswered a year agoDerrops a year agoI don't think this is really an answer in my opinion, at the end of the day this is creating a proxy with increase functionality between Cognito and your application. But if you could figure out the details of the user pool you could get the tokens through the hosted UI. Such an approach wouldn't be secure.Share0I have been having this issue and I think the only way is technically with Developer Attributes, which are not writable by an app client, but only admin-.. calls (not via access token either). If you did want these attributes to be in claims in your token however you will need to write a pre token lambda trigger.There is one downside to this approach in that if this attribute is mapped from an external identity provider a developer attribute won't work, as it will require an app client to write to it which app client's cannot do. If you aren't doing attribute mapping then this doesn't matter.CommentShareDerropsanswered a year ago"


Question: CONNECT race condition in AWS IoT

"I have a device with 2 modules which can connect to AWS IoT. They will never be connected at the same time, so I'm planning to use the same clientId for both modules. One of the modules is a leader and decides who should be connected: Leader (L) or Follower (F). The network connections they use might be of low quality. I'm wondering if it's possible to have a scenario like this:(F) is connected but because of network issues it has to reconnect and sends CONNECT to IoT(L) wants to take over the connection so tells (F) it takes over the connection. [(L) has high priority message to deliver and can't wait for ACK from (F) that it has disconnected](L) connects to IoT and sends CONNECT and receives CONACKNetwork is slow and only now CONNECT sent by (F) arrives to IoT which knocks off (F) from IoTIs this scenario possible or IoT takes care of this (for instance using timestamp sent in requests)? I know that (L) can reconnect upon disconnection, but network might be slow/unreliable so it might introduce significant latency which I have to avoid.FollowComment"

Answer: "1MQTT does not have a time synchronization protocol, hence AWS IOT Core can only consider the order in which the packets arrive to the gateway. In the case you describe, this will happen:F sends CONNECTL sends CONNECTL CONNECT is received by AWS IoT Core, hence L is now connectedF CONNECT is received (same clientId as L). AWS IoT Core disconnects L and F is now connectedL receives a DISCONNECT message.L reconnectsF is disconnectedF should know (according to your internal protocol) that L has taken over the connection, and should not reconnectCommentShareEXPERTMassimilianoAWSanswered a year ago"


Question: SPF and DKIM failure through Gmail

"Hi Guys,First-time poster here.I'm using SES. My DKIM and SPF authentications are failing. I've added SES's SMPT credentials to my Gmail account and I send the email through Gmail.What should I do to authenticate my emails?  This is the last DMARC report's relevant section I think://<record><row><source_ip>209.85.214.180</source_ip><count>1</count><policy_evaluated><disposition>quarantine</disposition><dkim>fail</dkim><spf>fail</spf></policy_evaluated></row><identifiers><envelope_from>gmail.com</envelope_from><header_from>emasons.tech</header_from></identifiers><auth_results><spf><domain>gmail.com</domain><result>pass</result></spf></auth_results>//Thank you!FollowComment"

Answer: "1Hi,First of all you should set a DKIM for your domain via SES. You can use Easy DKIM setup. Here is the steps:To set up Easy DKIM for a domainSign in to the AWS Management Console and open the Amazon SES console at https://console.aws.amazon.com/ses/In the navigation pane, under Configuration, choose Verified identities.In the list of identities, choose an identity where the Identity type is Domain.Under the Authentication tab, in the DomainKeys Identified Mail (DKIM) container, choose Edit.In the Advanced DKIM settings container, choose the Easy DKIM button in the Identity type field.In the DKIM signing key length field, choose either RSA_2048_BIT or RSA_1024_BIT.In the DKIM signatures field, check the Enabled box.Choose Save changes.Now that you’ve configured your domain identity with Easy DKIM, you must complete the verification process with your DNS provider.CommentShareErcananswered a year agoAWS-emasons-tech a year agoThat part is done//DKIM configurationSuccessful//Share"


Question: AWS Client VPN Federated to Azure fails with Invalid IDP metadata passed

After following all available documentation on how to federate AWS Client VPN to Azure when I go to create the VPN in the VPC the following error is returned - "There was an error creating your client VPN endpoint Invalid IDP metadata passed." The IDP metadata is imported properly into an IAM Identity Provider and everything looks correct.  This error occurs at the time of VPN creation.FollowComment


Question: s3 access error in lambda using ruby 2.7

"Inside my function i have (require "aws-sdk-s3" is called before the function definition):s3_client = Aws::S3::Client.new(region: 'us-west-2')s3_object = s3_client.get_object({bucket: <my bucket arn, copied from the bucket's page on the s3 admin console. It's formatted like: arn:aws:s3:::<bucketname>>,key: <my object id>,})puts s3_objectBut I get an error "Only Access Point and Outpost Access Point type ARNs are currently supported.". Why is this happening & how can this be fixed? Thanks!Edited by: hc4zrr324 on Nov 12, 2020 9:30 AMFollowComment"

Answer: 0must use the bucket name not the arn for ruby sdk.CommentSharehc4zrr324answered 3 years ago


Question: SPF Alignment for Amazon SES

"Hello everyone.Emails sent from my website using Amazon SES wind up in Gmail’s junk folders.A spam testing tool reported: Your "from" address does not match your SPF "from" address.Your From domain is: mydomail.comYour SPF MailFrom domain is: us-east-2.amazonses.comFollowing instructions on how to rectify this, I created & verified an identity for my domain in the Amazon SES panel, published the 3 CNAME record entries in my Cloudflare DNS, then created a “Custom MAIL FROM domain” (mail.mydomain.com) and entered the supplied SPF record in the Cloudflare DNS.According to the instructions I’m following, that is all I need to do in order for my emails to appear as being mailed by mydomain.comAmazon detected all DNS entries, but mydomain emails are still showing up as mailed-by us-east-2.amazonses.com and signed-by mydomain.com, as a result, going to spam.Even the test email sent from AWS SES Panel to my personal Gmail account go to Spam folderIs there something further I need to do?Regards.MarlonFollowComment"


Question: Stuck deployment in “ In process”

"I am deploying the components from s3 bucket, but it stucked in “In process”. I think it is permissions error for this, I followed  [https://docs.aws.amazon.com/greengrass/v2/developerguide/device-service-role.html].  But it still in process, can anyone tell me the more about it.Thank youNikFollowCommentGreg_B EXPERT3 months agoHi Nik. I think you need to improve this question and give us more information so we can help you. Are you deploying to a group or a single thing? Have you ever successfully deployed? Are you sure it says "in process"? I can't think of anything to do with Greengrass deployments that would say that, so maybe a screenshot would help.ShareNik 3 months agoYeah Greg_B, I am doing deploying to a group, and done local deployments successfully. Now I am deploying the component using s3 bucket, yes I am sure it is ‘In process’ I have checked /greengrass/v2/deployments, that shows ongoing deployment.Share"

Answer: "0If the deployment status is stuck in "In process", it is possible that there is a permissions issue causing the deployment to fail. Here are some steps you can take to troubleshoot the issue:Check the AWS CloudTrail logs to see if there are any errors or permission issues related to the S3 bucket or the service role. You can use CloudTrail to track the activities and events in your AWS account.Ensure that the S3 bucket is not encrypted with an unsupported encryption type.Verify that the AWS IoT Greengrass service role has the necessary permissions to access the S3 bucket. The role should have permission to read objects from the bucket and list the contents of the bucket.CommentShareKanavpreet Singhanswered 3 months ago"


Question: HOW TO GET JSON AWS IOT TO DEPLOY ON WEBSITE

"HELLO, I'M DOING MY T.C.C, AND I CONNECTED THE AWS IOT TO MY ESP32 AND I SEND THE JSON TO MQTT TEST, IT CONNECTS AND SENDS IT IN JSON INSIDE THE "MQTT TEST" OPTION BUT I WANT TO RECEIVE THIS JSON AND SEND IT TO MY WEBSITE THAT I AM DEVELOPING, BUT IM NOT GETTING IT, HOW DO I DO IT? I CAN ONLY DOWNLOAD THE JSON FILE, BUT IT IS NOT IN REAL TIME.PLEASE I REALLY NEED THIS.FollowComment"

Answer: "1Hi,If you want to have near-realtime message delivery to your web application you can check the following example on how to integrate a web application with AWS IoT Corehttps://github.com/aws/aws-iot-device-sdk-js-v2/tree/main/samples/browser/pub_subAlerts or specific events can also be sent to recipients via SNS or stored in a database like DynamoDB using AWS IoT Rules.Cheers,MassimilianoCommentShareEXPERTMassimilianoAWSanswered 6 months agoLeonardo Carraro 6 months agoIs there an option to generate a link to these json responses?ShareMassimilianoAWS EXPERT6 months agoCan you be more specific about the use case? Do you mean a deep link URL so that a user can come back to that response at a later time?ShareLeonardo Carraro 6 months agoI'm sending from esp32 to aws iot core all the responses from the sensors in json, it is in the topic "MQTT TEST CLIENT" AS "esp/pub" there arrives all the response in JSON in real time from "esp" I wanted to generate a link of these answers in JSON so that I can process and record them in my system.ShareMassimilianoAWS EXPERT6 months agoHi Leonardo,look at the link I sent you about IoT Rules. You can store the messages in several services, but if your data is some sort of timeseries data (such as temperature readings) I would advice to store them in Amazon Timestream. You can then query the data from your system and do whichever post processing needed.This workshop covers most of the topics: https://catalog.us-east-1.prod.workshops.aws/workshops/d74051cc-2575-4d5b-a30a-2169a094efe2Share"


Question: Does CodeBuild support fetching from private GitHub repository?

"I have been trying to use a private GitHub repository to build a few micro-services with CodeBuild and have not been able to do it successfully. After investigating a little bit more I believe I had read somewhere that if you are using GitHub the repository MUST be public, otherwise we need to use CodeCommit or another solution. Is this the case?Thanks in advanced!FollowComment"

Answer: 0That's incorrect. You can connect to private GitHub repository using OAuth[1] or Personal access tokens[2]. CodeBuild user guide has couple of samples to walk you through step by step for configuring this. Note that OAuth connection will need you to configure it through the console UI. Personal access token though can be setup by invoking the ImportSourceCredentials API.[1]: https://docs.aws.amazon.com/codebuild/latest/userguide/sample-github-pull-request.html[2]: https://docs.aws.amazon.com/codebuild/latest/userguide/sample-access-tokens.htmlCommentShareSubin Manswered 3 years ago


Question: EFS error 'One or more LifecyclePolicy objects specified are malformed.' with CDK v2

"I followed that example building an EFS share using CDK v2: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_efs.LifecyclePolicy.html#example what in my case looks like this:    const fileSystem = new efs.FileSystem(this, 'efsFileSystem', {      removalPolicy: cdk.RemovalPolicy.DESTROY,      vpc: vpc,      lifecyclePolicy: efs.LifecyclePolicy.AFTER_7_DAYS, // <-- causes error      performanceMode: efs.PerformanceMode.GENERAL_PURPOSE,      outOfInfrequentAccessPolicy: efs.OutOfInfrequentAccessPolicy.AFTER_1_ACCESS,       encrypted: false, //public data, no need for that      enableAutomaticBackups: false //public data, no need for that    }); When running cdk deploy, I get the errorResource handler returned message: "One or more LifecyclePolicy objects specified are malformed. (Service: Efs, Status Code: 400, Request ID: ..., Extended Request ID: null)" (RequestToken: ..., HandlerErrorCode: GeneralServiceException)When I omit lifecyclePolicy line it works fine.Is that a known issue or do I overlook something?FollowComment"


Question: CodeDeploy AfterAllowTestTraffic ECS hook doesn't behave as expected

"I am following this AWS guide to create a CodeDeploy blue/green deployment on ECS. In the example I've modified the Lambda hook function AfterAllowTestTraffic to make a simple axios.get(<application_load_balancer_dns:test-listener-port>) call for the test listener on port 8080, which should return 200 if the replacement task is successfully deployed.However, it seems that the Lambda function is called too early during AfterAllowTestTraffic, because it originally hits the original task set (blue) and returns 200 resulting in a successful deploy, despite documentation saying the below:AfterAllowTestTraffic  –  Use to run tasks after the test listener serves traffic to the replacement task setThis is unexpected behaviour because I deliberately deployed a broken replacement (green) task using this hook, so it should have failed since the test traffic would be serving the broken green task.I tested this by implementing a timeout in the Lambda function, and then pinging the URL 10 seconds later - this returned a 502 error as expected. I also verified in ECS logs that the axios call incorrectly hit the blue task, before subsequently hitting the green one. Access logs for the application load balancer also show the axios call to the blue target group.There must be something I'm missing here, but it doesn't make any sense to us. Any insight would be much appreciated!FollowCommentmleonrivas 6 months agoI've seen the same problem, at least with NLBs with TCP. The hook is invoked actually before the redirection of the test listener to the green target group is effective. The request ends up in the blue target group.Share"


Question: Disable ManageMasterUserPassword

"For a MySQL database, I turned on "Manage master credentials" in AWS console. I decided to use a "master password" instead. When I uncheck the ManageMasterUserPassword and assign a "master password", AWS console gives me an error , "You can't specify MasterUserPassword for an instance with ManageMasterUserPassword enabled."FollowComment"

Answer: "0Hello,I understand that you tried to reset the master user password but it failed with error below:   "You can't specify MasterUserPassword for an instance with ManageMasterUserPassword enabled."This message indicates that you cannot update the master user manually as it is being managed by secret manager.I would suggest you to try to disable master credentials management via console or CLI. Please find more information below.To modify the master user credential management in secret manager of your DB instance, you can use the following steps on console or the CLI command:AWS Console:> Open the Amazon RDS console.> Select Databases.> Select the RDS/Aurora DB instance, and then choose Modify.> Uncheck the box: "Manage master credentials in AWS Secrets Manager in Credential settings"    > Save the settingsVia CLI:aws rds modify-db-cluster \--db-cluster-identifier dbidentifier\--no-manage-master-user-password \    --master-user-password "NewPassword"--apply-immediatelyCommentShareAditya_Sanswered 2 months agoSatheesh Kakarla 2 months agoI'm getting the same error Aditya, After Unchecking the box in modification it was asking me for the new master password. After entering the password and clicking continue and I selected Apply immediately and clicked on modify DB instance it was showing same error as below**Error **"We're sorry, your request to modify DB instance uat-atlas has failed.You can't specify MasterUserPassword for an instance with ManageMasterUserPassword enabled."Share"


Question: Multiple starts + bad timing w/ db container?

"I have a deployment with a private php:7.4-apache derivative image container and a database container. When I launch my deployment, it is failing, but I don't know why. For some reason, it appears to start multiple times:[28/Dec/2021:16:16:15] [deployment:33] Creating your deployment[28/Dec/2021:16:17:05] > Wrote the baseURL ([REDACTED].us-east-1.cs.amazonlightsail.com) to .env[28/Dec/2021:16:17:05] [File\Write] Writing to /var/www/fairs/.env.[28/Dec/2021:16:18:11] [deployment:33] Started 1 new node[28/Dec/2021:16:19:18] [File\Write] Writing to /var/www/fairs/.env.[28/Dec/2021:16:19:18] > Wrote the baseURL ([REDACTED].us-east-1.cs.amazonlightsail.com) to .env[28/Dec/2021:16:20:21] [deployment:33] Started 1 new node[28/Dec/2021:16:20:49] [deployment:33] Took too longI also have a mysql import in my launch command that fails whenever I try to import a database snapshot:[28/Dec/2021:19:23:00] ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2)But when I look at the logs of my db container, it doesn't appear to be ready at that exact time.:[28/Dec/2021:19:22:07] [deployment:35] Creating your deployment[28/Dec/2021:19:22:59] 2021-12-28 19:22:59+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 5.7.33-1debian10 started.[28/Dec/2021:19:22:59] 2021-12-28 19:22:59+00:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql'[28/Dec/2021:19:23:00] 2021-12-28 19:22:59+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 5.7.33-1debian10 started.[28/Dec/2021:19:23:00] 2021-12-28 19:23:00+00:00 [Note] [Entrypoint]: Initializing database files[28/Dec/2021:19:23:00] 2021-12-28T19:23:00.385802Z 0 [Warning] Changed limits: max_open_files: 1024 (requested 5000)[28/Dec/2021:19:23:00] 2021-12-28T19:23:00.385858Z 0 [Warning] Changed limits: table_open_cache: 431 (requested 2000)[28/Dec/2021:19:23:00] 2021-12-28T19:23:00.385992Z 0 [Warning] TIMESTAMP with implicit DEFAULT value is deprecated. Please use --explicit_defaults_for_timestamp server option (see documentation for more details).[28/Dec/2021:19:23:00] 2021-12-28T19:23:00.791276Z 0 [Warning] InnoDB: New log files created, LSN=45790[28/Dec/2021:19:23:00] 2021-12-28T19:23:00.843479Z 0 [Warning] InnoDB: Creating foreign key constraint system tables.[28/Dec/2021:19:23:00] 2021-12-28T19:23:00.904067Z 0 [Warning] No existing UUID has been found, so we assume that this is the first time that this server has been started. Generating a new UUID: 9240f4d4-6813-11ec-af07-0a58a9feac02.[28/Dec/2021:19:23:00] 2021-12-28T19:23:00.906067Z 0 [Warning] Gtid table is not ready to be used. Table 'mysql.gtid_executed' cannot be opened.[28/Dec/2021:19:23:02] 2021-12-28T19:23:02.285861Z 0 [Warning] CA certificate ca.pem is self signed....[28/Dec/2021:19:23:06] 2021-12-28T19:23:06.403308Z 0 [Note] mysqld: ready for connections.[28/Dec/2021:19:23:06] Version: '5.7.33' socket: '/var/run/mysqld/mysqld.sock' port: 0 MySQL Community Server (GPL)When I take out the launch command in my container, it launches fine. Is the command supposed to return something to indicate that it's done and ok? I need the launch command to configure my app and import the database.FollowComment"


Question: ResourceLimitExceeded exception but I have Quota

"I am not able to to start a SageMaker notebook neither a SageMaker training job with ml.c5.xlarge (or any other instance type).  I checked on "Quota Services", and I clearly have quotes for both tasks.1 in "applied quota value" for "ml.c5.xlarge for notebook instance usage".15 in "applied quota value" for "ml.c5.xlarge for training job usage".Of course I am checking in the same region I try to work: "us-east-1".I have researched for several days, and all forum suggests to ask for a limit increase. Nevertheless, I already have quota (limits) available. Nevertheless, when I try to start the Jupyter notebook, it raise the exception The account-level service limit 'ml.c5.xlarge for notebook instance usage' is 0 Instances, with current utilization of 0 Instances and a request delta of 1 Instances. Please contact AWS support to request an increase for this limit.It is strange because the exception says that I have a limit of 0 instances, while the quota list services says I have 1.Here's the output of the command service-quotas list-service-quotas        {            "ServiceCode": "sagemaker",            "ServiceName": "Amazon SageMaker",            "QuotaArn": "arn:aws:servicequotas:us-east-1:631720213551:sagemaker/L-E2BB44FE",            "QuotaCode": "L-E2BB44FE",            "QuotaName": "ml.c5.xlarge for training job usage",            "Value": 15.0,            "Unit": "None",            "Adjustable": true,            "GlobalQuota": false        },        {            "ServiceCode": "sagemaker",            "ServiceName": "Amazon SageMaker",            "QuotaArn": "arn:aws:servicequotas:us-east-1:631720213551:sagemaker/L-39F5FD98",            "QuotaCode": "L-39F5FD98",            "QuotaName": "ml.c5.xlarge for notebook instance usage",            "Value": 1.0,            "Unit": "None",            "Adjustable": true,            "GlobalQuota": false,            "UsageMetric": {                "MetricNamespace": "AWS/Usage",                "MetricName": "ResourceCount",                "MetricDimensions": {                    "Class": "None",                    "Resource": "notebook-instance/ml.c5.xlarge",                    "Service": "SageMaker",                    "Type": "Resource"                },                "MetricStatisticRecommendation": "Maximum"            }        },I strongly appreciate your help, because I have no way to open a SageMaker training job for several days.Thanks.FollowCommentakatzfey 8 months agoI am also having this issue with 2 different AWS accounts. I'm completely unable to continue forward with my testing and development until my quota increase requests for training job instances are resolved. It seems absolutely insane to me that one of Amazon's flagship services is completely unusable at the moment without opening support tickets and waiting several days for a response.Share"

Answer: "0There was a recent AWS Supports You episode on Twitch, https://www.youtube.com/watch?v=-nfDpE3Rr3Y, where several re:Post questions were covered. You can see an answer to this question at the 28.57 mark.CommentShareStephenHeverin_AWSanswered 7 months ago"


Question: how to get the "RuleResults" of a Glue Studio DataQuality job

"How to get the "RuleResults" generated by a glue studio job that have some dataquality rules, in the dataQuality Tab of the job i can manually download the results to a file when appears the "RuleResults". i have one step function where calls that job, i would like to know the output of that file(where was generated and the key in s3, too) to evaluate in a next step(i.e lambda function) which rules were'nt passed and which ones yes. tkxFollowComment"

Answer: "0Glue API only returns Job Id in the response. AWS Glue Jobs are designed not to return values.If the file from Glue is getting uploaded to s3, a separate Lambda can be triggered using S3 event itself. After evaluation, the data can be uploaded to a dynamoDB or another datastore which then can be retrieved by Lambda function configured in state machine with a wait step for s3 triggered Lambda to complete processing.Helpful documentations:https://docs.aws.amazon.com/lambda/latest/dg/with-s3-example.htmlhttps://docs.aws.amazon.com/step-functions/latest/dg/amazon-states-language-wait-state.htmlhttps://meurub.medium.com/receiving-values-from-a-aws-glue-job-ebc6b7386008https://stackoverflow.com/questions/58222209/how-to-return-output-from-aws-glue-jobs-back-to-the-calling-step-function-workflCommentShareSUPPORT ENGINEERSumit_K-Ranswered 2 months ago"


Question: Enabling "Allow" in instance metadata

"I have been trying to enable "Allow" option in Instance metadata tag using boto3 and referred to the below format from link shared belowresponse = client.modify_instance_metadata_options(InstanceId='string',HttpTokens='optional'|'required',HttpPutResponseHopLimit=123,HttpEndpoint='disabled'|'enabled',DryRun=True|False,HttpProtocolIpv6='disabled'|'enabled',InstanceMetadataTags='disabled'|'enabled')ref link : https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ec2.html?highlight=vpcendpoint#EC2.Client.modify_instance_metadata_optionshttps://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.htmlWith the above reference , please find the usage in my case as below****USAGE : ****client = self.get_service(service_type, region)client.modify_instance_metadata_options(InstanceId=resource_id,InstanceMetadataTags="enabled")While executing the above scenarios, am facing Unknown parameter in inputE               botocore.exceptions.ParamValidationError: Parameter validation failed:E               Unknown parameter in input: "InstanceMetadataTags", must be one of: InstanceId, HttpTokens, HttpPutResponseHopLimit, HttpEndpoint, DryRunIt'll be really helpful if anyone could help me in correct usage or in resolving thisTIAFollowComment"

Answer: 0Have you checked the version of boto3 and botocore that you're running to make sure that it is the latest? The error message indicates that it doesn't recognise InstanceMetadataTags so my guess here is that the version you're running is earlier than is required to support that parameter.CommentShareEXPERTBrettski-AWSanswered 10 months ago


Question: Is there an event for game session termination?

"Hello!I'm trying to migrate my current dedicated server from playfab to gamelift, and Playfab had an event for session closing, that I could catch in cloud code. I've used this to handle reconnecting of players who had some network issues/crashing.So far I've found nothing similar in gamelift. Is there a way to get an event out to lambda or SNS every time a game session closes (for any reason, ended, crashed, terminated, all need to be caught)?Thank you!FollowComment"

Answer: "0Accepted AnswerHi @REDACTEDUSERSorry for the late reply. GameLift logs process abnormal termination in fleet events (accessible via DescribeFleetEvents, e.g. SERVER_PROCESS_CRASHED, see [doc](https://docs.aws.amazon.com/id_id/cli/latest/reference/gamelift/describe-fleet-******So, you can poll DescribeFleetEvent to see whether game session has crashed. Hopefully this suffices your use case in the short term. We currently do not offer fleet events in SNS, but this has been requested in the past and is being tracked in our backlog.#14510CommentSharerePost-User-7108006answered a year ago0When calling InitSDK in your server, it takes in a parameter of type ProcessParameters, which takes in a handler function called onProcessTerminate that I believe fits your needs in this situation. For more info, check https://docs.aws.amazon.com/gamelift/latest/developerguide/integration-server-sdk-cpp-ref-datatypes.html#integration-server-sdk-cpp-ref-dataypes-processCommentSharerePost-User-5100160answered a year ago0Thank you for your answer, but it doesn't fit my need. In case of process crashing, it cannot catch it.The gamelift service itself knows when a game is terminated, because it can gather logs, and upload them on s3, I believe, so I was wondering if there is an event there I could catch.CommentSharerePost-User-1837780answered a year ago0Would also like to know if there's an event similar to the FlexMatch or placement events that can trigger when a game session is terminated. Currently we're invoking a lambda on termination from the game script, but crashes are indeed a problem. We're currently tracking our player's status (playing/idle), and if a player is attempting an API call (for example, start matchmaking) when they're already in playing state, we're polling gamelift via describe player session to see if it shows as terminated and if it is, then we're assuming that the gamescript has crashedCommentSharerePost-User-7390418answered a year ago0Thanks for the reply!Using the other API polling calls is discouraged, is that similar for this one? Is there a limit on the frequency of calling DescribeFleetEvent?@REDACTEDUSERprocess.on('uncaughtException', function(error) {InvokeSessionCompletionListenerLambda();});process.on('unhandledRejection', function(reason, p){InvokeSessionCompletionListenerLambda();});CommentSharerePost-User-7390418answered a year ago0Using the other API polling calls is discouraged, is that similar for this one?That would be the case if there is a better alternative using push. Also, different from DescribeMatchmaking, DescribeGameSessionPlacement or DescribeGameSession, (which are the 3 APIs that customers incorrectly poll the most) which are not scalable to poll because you'd hit a bottleneck beyond a certain point as your game grows. However, since there is only limited number of fleet regardless of how large your game is, polling DescribeFleetEvent is reasonably scalable.CommentSharerePost-User-7108006answered a year ago"


Question: API gateway not working with custom domain

"Hello,I am trying to use API gateway with a lambda function, but with my own domain (which is on route 53). This is my current config:in API gateway I created a resource with a GET method, and I published it to a stage I called v1. I get an endpoint likehttps://11111111.execute-api.us-east-1.amazonaws.com/v1if I call this endpoint I can see the reply from my lambda function. so far so good.Then In API gateway again, I made a custom domain name for api.mydomain.com, and I get something like22222222.execute-api.us-east-1.amazonaws.comfinally in route 53 I created a record type A (api.mydomain.com), marked as ALIAS and with value22222222.execute-api.us-east-1.amazonaws.comIf I try to call https://api.mydomain.com/v1 I get a 403 error.Am I missing something?Also, do I need to enable CORS to allow any browser to call this endpoint?FollowCommentalatech EXPERT2 months agoDid you go through this? https://aws.amazon.com/premiumsupport/knowledge-center/custom-domain-name-amazon-api-gateway/Share"

Answer: "0Thank you for the detailed description. To proceed, check the x-amzn-errortype header in the 403 error and refer to this article for the resolution.Based on the description, it's likely that the 403 is due to the domain URL includes the stage while stage (v1 in the provided example) is not necessary.CommentShareweidianswered 2 months ago0Hello, the x-amzn-errortype value is "ForbiddenException". I can see several use cases for that in the page you indicated.I also tried to call my endpoint without the stage but I got the same error.I'd need stages anyway as I want to be able to test my API on another stage.thank youCommentSharerePost-User-3116220answered 2 months ago"