Question: Every stack update tries to optimize gp3 volume

"We have a stack which went through the following series of events:Created EBS volumes of type st1 and attached them to EC2 volumes.Later decided to convert these to gp3 when it was announced. Changed the VolumeType in the stack and applied an update.The volumes started optimizing.~7 hours after initiating the update, the update failed and the stack went to being stuck in UPDATE_ROLLBACK_FAILED. CloudFormation tried to roll back the change, but could not do so. The status messages for each volume indicates:"Volume vol-... cannot be modified in modification state OPTIMIZING (Service: AmazonEC2; Status Code: 400; Error Code: IncorrectModificationState; Request ID: ...; Proxy: null)".A couple of days later the volume optimization finished. The EBS console shows gp3, and on the EC2 instances, we quite clearly see gp3 performance and not the previous st1. In CloudFormation the volumes show UPDATE_FAILED.Some time later we had to deploy another stack update to set throughput and IOPS of the gp3 volumes. Could not do so due to being stuck in UPDATE_ROLLBACK_FAILED.We rolled back the stack and excluded the volumes. Stack was now in UPDATE_ROLLBACK_COMPLETE and volumes were now in UPDATE_COMPLETE, and we deployed the updated stack.The volumes started optimizing again. It took over a day but eventually optimization finished.Once again, ~7 hours after starting the stack update, the update failed and the stack went to UPDATE_ROLLBACK_FAILED. Same messages for the volumes.After the volume optimization finished, the new throughput and IOPS are shown in the console. CloudWatch metrics show that the volume usage reflects with the new values.Today we had another update to the volumes. In this case we were only changing tags. All of the volumes except 1 started optimizing. The new tags were set, but the stack update failed due to a different reason, CloudFormation tried to roll back, and once again the volumes are now UPDATE_FAILED and the stack is UPDATE_ROLLBACK_FAILED, with the exact same message for the volumes. The volumes are still optimizing ~3 hours later.We think the original problem was that we hit some kind of internal timeout in CloudFormation. No idea why it tries to optimize the volumes every time - shouldn't the most recent tag-only update not require optimization?Is there anything we can adjust in the template, or during the update, to force CloudFormation to fully wait for volume optimization, or to bypass the attempt to optimize every time? I've considered creating a wait condition and manually resolving it (using cURL or whatever) once we see that the optimization completes, just to get it out of the way. I've also considered creating a stack policy to prevent updates to the EBS volumes but that doesn't guarantee that we won't run into this exact same problem if we need remove the policy to update the volumes in the future.FollowComment"

Answer: "0I got an answer from support. The issue was that the user credentials used for the operation when applying from the console expire after ~7 hours, but IAM service role accounts have a much longer timeout, so applying the update using the service role allowed the operation to completely wait for the optimization/conversion process.As for the re-optimization of the volumes, the AWS::EC2::Volume documentation https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-ebs-volume.html states that a cooldown period is enforced when changing Iops, Size, or VolumeType; my reading of it is that this refers to the optimization process. I saw that the optimization was triggered when changing Iops even after successfully updating the stack to the gp3 version, so I guess that's just the behavior of CloudFormation and/or EBS.CommentSharecavanswered 2 years ago"


Question: Building the GameLift Server SDK plugin for Unreal Engine versions greater than 4.21

"In the past, I have not dealt with any errors while building the plugin when I add it on a per-project basis, meaning I usually add the plugin to a Plugin folder in my Unreal projects rather than Unreal Engine's Engine\Plugins folder. I have made a somewhat similar post about suppressing some warnings, but now I want to address how to solve actual compiler errors in addition to warnings when you try to add the plugin to Unreal Engine itself. And again, I am not sure at all why this only happens when adding the plugin directly to the engine as opposed to adding the plugin to individual projects.Assuming you are using the plugin in the UE4.21.1 folder in GameLift_09_03_2019\GameLift-SDK-Release-3.4.0\GameLift-Unreal-plugin-3.3.0,First, to remove the "Refrenced directory ... does not exist" warnings in GameLiftServerSDK.Build.cs, replace the first two lines in the GameLiftServerSDK constructor,PublicIncludePaths.AddRange(    new string[] {    "GameLiftServerSDK/Public"    });  PrivateIncludePaths.AddRange(    new string[] {    "GameLiftServerSDK/Private",    });withPublicIncludePaths.Add(System.IO.Path.Combine(ModuleDirectory, "Public"));PrivateIncludePaths.Add(System.IO.Path.Combine(ModuleDirectory, "Private"));Next, there are also two instances of this line, PublicLibraryPaths.Add(SDKDirectory); causing compiler warnings because PublicLibraryPaths is obsolete in newer versions of Unreal Engine, so you can either replace each instance of this line with PublicAdditionalLibraries.Add(SDKDirectory); or with PublicSystemLibraries.Add(SDKDirectory);. Or you can even get rid of each instance of that line altogether.Moving on to actual compiler errors, in GameLiftServerSDK.h, some of the include statements are incorrect. For example,#include "ModuleManager.h" should be #include "Modules/ModuleManager.h"#include "DelegateCombinations.h" should be #include "Delegates/DelegateCombinations.h" #include "AllowWindowsPlatformTypes.h" should be#include "Windows/AllowWindowsPlatformTypes.h""#include "HideWindowsPlatformTypes.h" should be #include "Windows/HideWindowsPlatformTypes.h" Similarly in GameLiftServerSDK.cpp, the following include statement should be fixed,#include "ModuleManager.h" should be #include "Modules/ModuleManager.h" #include "IPluginManager.h" should be #include "Interfaces/IPluginManager.h" There is also an include statement missing in GameLiftServerSDK.cpp, the include for its own header file. And this include statement has to be the very first include statement in this cpp file,#include "GameLiftServerSDK.h"Lastly, there is an include statement #include "Core.h" that may trigger a compiler warning related to IWYU, because it is not recommended to import monolithic header files, but I have not found a workaround for this.I will update this post appropriately if I find anything new, but hope this helps people who are experiencing issues when trying to build the UE4 plugin for versions of Unreal Engine greater than 4.21.FollowComment"

Answer: "0Accepted Answer@REDACTEDUSERCommentSharerePost-User-5332620answered 3 years ago0Yeah, I can confirm this. I did something similar for my example project. Here is the commit with all changes for Server SDK. I skipped warnings fixes because they're not necessary for the demo, though important of course. Another point: I needed additional public definition otherwise project won't link.You're welcome to explore my code or corresponding article if anyone interesting. It could be helpful too.CommentSharerePost-User-0203995answered 3 years ago0Hey @REDACTEDUSERPublicDefinitions.Add("USE_IMPORT_EXPORT");I remember I needed this in the Yetitech client sdk a while ago but I am curious as to why you included this in the server sdk. What is the error that you get when you remove this line? And does this only happen when using both the server sdk and client sdk? Only asking because I don't seem to need this line when I use the server sdk alone.But thanks for the project and article, I always meant to go back and fix my pull request to the yeti tech client sdk despite not using it anymore.CommentSharerePost-User-5100160answered 3 years ago0Just wondering, did you add this line in the GameLiftServerSDK.Build.cs file?Yes, you can see it in the commit.What is the error that you get when you remove this line?Linkage errors. Either not defined symbols or double defined symbols. If I not mistaken it was constructors of Aws::GameLift::Server::Model::GameSession. They're inlined and that's fine but somehow the Unreal Build system refuses to see them properly. It worked perfectly in UE4.22 (I had a project on the older version); I guess, they've changed something in the build system.And does this only happen when using both the server sdk and client sdk?No, It happened before I even started integrating Client SDK.Exact error messages if I just comment out this public definition (I stripped my local paths):2>aws-cpp-sdk-gamelift-server.lib(aws-cpp-sdk-gamelift-server.dll) : error LNK2005: "public: __cdecl Aws::GameLift::Server::Model::GameSession::~GameSession(void)" (??1GameSession@Model@Server@GameLift@Aws@@QEAA@XZ) already defined in GameLiftServerSDK.cpp.obj2>aws-cpp-sdk-gamelift-server.lib(aws-cpp-sdk-gamelift-server.dll) : error LNK2005: "public: __cdecl Aws::GameLift::Server::Model::GameSession::GameSession(class Aws::GameLift::Server::Model::GameSession const &)" (??0GameSession@Model@Server@GameLift@Aws@@QEAA@AEBV01234@@Z) already defined in GameLiftServerSDK.cpp.obj2>     Creating library <path>\UE4GameLift\Binaries\Win64\UE4GameLiftServer.lib and object <path>\UE4GameLift\Binaries\Win64\UE4GameLiftServer.exp2><path>\UE4GameLift\Binaries\Win64\UE4GameLiftServer.exe : fatal error LNK1169: one or more multiply defined symbols foundCommentSharerePost-User-0203995answered 3 years ago"


Question: How to pull amplify backend without error? (Might related python env?)

"Hi,I tried to pull the backend by the cli command that shows in Amplify console, but got an error.amplify pull --appId xxxxxxxxxx --envName yyyyyyyyyyMy environment:amplify --version10.0.0python --versionPython 3.9.13pyenv --versionpyenv 2.3.3How should I do to solve this?Error:Failed to pull the backend.Report saved: /ar/folders/xp/....Sending zipFile at path: '/xxxxxxxxxx/amplify/backend/amplify-meta.json' does not exist✖ Sending zip🛑 ENOENT: no such file or directory, stat '/xxxxxxxxxx/amplify/.temp/#current-cloud-backend/function/xxxxxxxxxx/.venv/bin/python'Error: ENOENT: no such file or directory, stat '/xxxxxxxxxx/amplify/.temp/#current-cloud-backend/function/xxxxxxxxxx/.venv/bin/python'at Object.statSync (fs.js:1131:3)at Object.statSync (pkg/prelude/bootstrap.js:1345:32)at Object.statSync (/snapshot/repo/build/node_modules/graceful-fs/polyfills.js:311:34)at getStatsSync (/snapshot/repo/build/node_modules/fs-extra/lib/util/stat.js:58:18)at Object.checkPathsSync (/snapshot/repo/build/node_modules/fs-extra/lib/util/stat.js:90:33)at copyDirItem (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:119:29)at /snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:113:39at Array.forEach (<anonymous>)at copyDir (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:113:23)at mkDirAndCopy (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:108:3)at onDir (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:99:25)at getStats (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:45:37)at startCopy (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:38:10)at copyDirItem (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:120:10)at /snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:113:39at Array.forEach (<anonymous>)at copyDir (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:113:23)at mkDirAndCopy (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:108:3)at onDir (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:99:25)at getStats (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:45:37)at startCopy (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:38:10)at copyDirItem (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:120:10)at /snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:113:39at Array.forEach (<anonymous>)at copyDir (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:113:23)at mkDirAndCopy (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:108:3)at onDir (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:99:25)at getStats (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:45:37)at startCopy (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:38:10)at copyDirItem (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:120:10)at /snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:113:39at Array.forEach (<anonymous>)at copyDir (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:113:23)at mkDirAndCopy (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:108:3)at onDir (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:99:25)at getStats (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:45:37)at startCopy (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:38:10)at copyDirItem (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:120:10)at /snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:113:39at Array.forEach (<anonymous>)at copyDir (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:113:23)at onDir (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:103:10)at getStats (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:45:37)at startCopy (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:38:10)at handleFilterAndCopy (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:33:10)at Object.copySync (/snapshot/repo/build/node_modules/fs-extra/lib/copy-sync/copy-sync.js:26:10)at downloadBackend (/snapshot/repo/build/node_modules/amplify-provider-awscloudformation/lib/attach-backend.js:389:8)at async Object.run (/snapshot/repo/build/node_modules/amplify-provider-awscloudformation/lib/attach-backend.js:116:3)at async Object.attachBackend (/snapshot/repo/build/node_modules/amplify-provider-awscloudformation/lib/index.js:208:3)at async queryProvider (/snapshot/repo/build/node_modules/@aws-amplify/cli-internal/lib/attach-backend-steps/a10-queryProvider.js:31:5)at async attachBackend (/snapshot/repo/build/node_modules/@aws-amplify/cli-internal/lib/attach-backend.js:38:9)at async Object.run (/snapshot/repo/build/node_modules/@aws-amplify/cli-internal/lib/commands/pull.js:70:9)at async Object.executeAmplifyCommand (/snapshot/repo/build/node_modules/@aws-amplify/cli-internal/lib/index.js:292:9)at async executePluginModuleCommand (/snapshot/repo/build/node_modules/@aws-amplify/cli-internal/lib/execution-manager.js:142:5)at async executeCommand (/snapshot/repo/build/node_modules/@aws-amplify/cli-internal/lib/execution-manager.js:40:9)at async Object.run (/snapshot/repo/build/node_modules/@aws-amplify/cli-internal/lib/index.js:165:13)Thanks,FollowComment"

Answer: "0Accepted AnswerHi Michihiro Ota,I believe this is an issue about incorrect symlinks configured for Amplify files and directories hence causing the failure of amplify pull command.You can find a similar GitHub Issue here.. It shows steps about how you can manually create symlinks and re-upload files in to the s3 deployment bucket for Amplify.Can you please upgrade your Amplify CLI to the latest version (10.3.2 and re run the command of amplify pull.You may also want to confirm that amplify-meta.json file is present in your ../backend sub-directory. To learn more about the amplify files/folders structure and its relevant purpose, please visit this page.Looking forward to hearing back from you. Hope my insights prove useful.CommentShareRaheel Maqsoodanswered 7 months agoMichihiro Ota 7 months agoHi Raheel,Thanks for quick response. After I just deleted the symlinks and followed the other steps, now I can pull normally.Thank you!ShareRaheel Maqsood 7 months agoHi,That's brilliant :D I am glad it worked for you.Share"


Question: Athena - convert string to timestamp

"I use the below query in Athena to parse string so I could so some filtering on the timestamp.The column event_time is a string in the format - 2023/04/28 15:32:39 UTC select date_parse(event_time, '%Y/%m/%d %H:%i:%S UTC')from "database"."table" ;I get the error INVALID_FUNCTION_ARGUMENT: Invalid format: ""2023/04/28 15:32:39 UTC""I don't see an issue with date_parse function because I am able to parse sample dates from the tableSELECT date_parse(TestData.MultiDateCol, '%Y/%m/%d %H:%i:%s UTC') as newDateFROM( SELECT '2023/04/28 15:32:39 UTC' AS MultiDateCol ) AS TestDataWhat am I doing wrong hereFollowComment"

Answer: "1Accepted AnswerCan you check if the event_time column has the quotes in it? If I run the query below I get the same message that you get with the same pair of double quotes on either end.SELECT date_parse(TestData.MultiDateCol, '%Y/%m/%d %H:%i:%s UTC') as newDateFROM( SELECT '"2023/04/28 15:32:39 UTC"' AS MultiDateCol ) AS TestDataINVALID_FUNCTION_ARGUMENT: Invalid format: ""2023/04/28 15:32:39 UTC""CommentShareMadhav Vishnubhattaanswered a month agoEXPERTFabrizio@AWSreviewed 23 days agobalumath a month agoThat is correct values have quotes in them- which was causing the confusionRecreated the table w/o quotes which fixed the issuesShare0Used the below DDL to create table w/o quotesCREATE EXTERNAL TABLE `my_table`(  ....ROW FORMAT SERDE   'org.apache.hadoop.hive.serde2.OpenCSVSerde' WITH SERDEPROPERTIES (   'escapeChar'='\\',   'quoteChar'='\"',   'separatorChar'=',') STORED AS INPUTFORMAT   'org.apache.hadoop.mapred.TextInputFormat' OUTPUTFORMAT   'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION  's3://....'CommentSharebalumathanswered a month ago"


Question: Access Denied Error in Athena query file

"I have a S3 bucket with some AVRO formatted files, I have successfully been through the steps to create a table based on the AVRO schema in Athena and can run SQL queries on the data that return a successful "Completed" response but no data is returned, In the query result bucket i have specified a csv file is created for each query that contains a Error xml block and a "Access Denied" message. I believe i have set up the bucket policy correctly, i am attempting to run this query on an user that is under the same account ID that the bucket was created in, so that seems like it should be straight forward. but it is not working for me and the lack of errors in Athena are confusing. I am stuck right now on what i have not set up correctly.FollowComment"

Answer: "0Looks like you don't have sufficient permissions to write the results to the query result bucket. Please refer the following link for more details, and it could be any of the reasons listed below..."You get an "Access Denied" error usually because of the following reasons:The AWS Identity and Access Management (IAM) user doesn't have one or more of the following permissions:Read the source data bucket.Write the results to the query result bucket.*The Amazon Simple Storage Service (Amazon S3) bucket policies don't allow the required permissions to the IAM user.The object owner is different from the Amazon S3 bucket owner.You don't have access to the AWS Key Management Service (AWS KMS) key that's used to read or write the encrypted data.The AWS Glue Data Catalog policy doesn't allow access to the IAM user."Check out the link for more details regarding the potential issues and how to solve them...https://aws.amazon.com/premiumsupport/knowledge-center/access-denied-athena/CommentShareamanbajwanswered a year agoAWS-User-9863699 a year agoThank you for the reply, so just for my understanding, if the use that made the bucket and is executing the query has the Athena and S3 full access policies attached via a group, is that not enough or does it need to be explicit to the exact resource im using, in this case a particular s3 bucket?Shareamanbajw a year agoYou also need to check the S3 bucket policies to make sure the user has access to the bucket(s). If the user has access to Athena and S3 but the S3 bucket policy doesn't give the user permissions to read/write to the buckets, you'll get the 'Access Denied' error. Also, check all the possible reasons why you can get the error in Athena in the link posted above and which I've enumerated below..."You get an "Access Denied" error usually because of the following reasons:The AWS Identity and Access Management (IAM) user doesn't have one or more of the following permissions:1a. Read the source data bucket.1b. Write the results to the query result bucket.The Amazon Simple Storage Service (Amazon S3) bucket policies don't allow the required permissions to the IAM user.The object owner is different from the Amazon S3 bucket owner.You don't have access to the AWS Key Management Service (AWS KMS) key that's used to read or write the encrypted data.The AWS Glue Data Catalog policy doesn't allow access to the IAM user."ShareFabrizio@AWS EXPERTa year agoAs indicated in the follow up comment there might be more reasons why you get a Access Denied, and based on the fact that the query runs it is the result bucket that might have issues, the user need write access to the query result bucket but also to the KMS key if it is encryptedThe answer might. be more readable if expanded directly with some of the information added in the foloow up comment.Share"


Question: Differeing PHP code behaviors

"My PHP -- specifically an elseif statement -- does not behave the same way on AL2 as it does on my CentOS 7 dev server.  Both systems are supposed to be running PHP v7.3.  I will note the AL2 system does not have the php-tidy module installed, and I am having GREAT difficulty adding it; but, I do not know if that has anything to do with the problem.  What would cause an if->elseif->else statement to perform one way on CentOS 7 and differently on AL2?  BTW, it would appear that PHP on the AL2 system is dropping the last '->else' part.  Also if I code the elseif part to be precisely $var === 1, it drops the 'elseif' part of the statement and does the else statement.if($var > 1) {  // echo HTML form stuff}elseif($var == 1) {  // echo HTML table header <th> code only (no form elements)  // There is an '&' in the text to be echoed}else{  // echo different HTML table header code, again no form elements  // There is a '/' in this text to be echoed}I'm not the best coder, but this code works PERFECTLY on CentOS 7, running PHP v7.3.33 (with the php-tidy module enabled.)  Any guidance you all could provide would be greatly appreciated.FollowComment"

Answer: "1Accepted AnswerYou'd need to debug value of $var on both setups and compare it. It's obvious that it will be different, and then based on result you can try to understand the root cause of difference. The simplest way to debug is to add var_dump($var); before that if-elseif-else statement.CommentShareA-Shevchenkoanswered a year agoAngryAdmin a year agoThis is the solution.  I am doing an array_column on a column coming out of the database; but, the related table in the Prod database was one row shorter than the Dev database -- as was revealed to me by the var_dump($var); procedure.  Suffice it to say, I am very glad my concerns about the PHP Runtime environment were unfounded.Share1IMO the root cause of your issue will be the use of the "Equal" comparator. PHP is a loosely typed language and using == (Equal) instead of === (Identical) allows PHP to automatically cast either value before making the comparison.  This effect is compounded when a value is 0 or 1 because they will be interchanged with TRUE & FALSE so your initial intention to verify that the value of $var is "1" will become "is there a value in $var?"You can read more about Comparison Operators on the PHP docs.In a case where you are using two different Operating Systems, I would imagine you are dealing with different default PHP Runtime Configurations.  To verify this you can export the current configuration from each instance using the phpinfo() function and perform a Diff.BTW, don't leave the function accessible for longer than you need it as this is a security risk.CommentShareDaniel Craigieanswered a year agoAngryAdmin a year agoThank you for that clarification about the Equal vs Identical, it is very interesting that == is just TRUE or FALSE, in that situation.  I've tried to redo the ifelse statement, and if I set the variable to $var === '1', (with the single-quotes around the 1), I can get that part of the statement to work, but it seems that as soon as it decides it has determined which operation to do, it just breaks out of the if->ifelse->else statement completely, even though this statement is nested within a for statement which is still counting and incrementing a variable.I must mention this code works fine (even if it's just deciding TRUE or FALSE and not actually verifying the value of $var), on my CentOS dev server.  I will also note that my dev server has 'Thread Safety' off, and the AL2 system has it turned on.  Could it be Thread Safety that is breaking out of the ifelse statement?  The Dev server is also using php-fpm and AL2 is not; some other seemingly unrelated php modules -- bcmath, mcrypt, tidy -- are running on Dev but not on AL2 as well.  Why would enabling php-tidy, for example, have any effect on the way PHP 7.3.29 handles an ifelse statement?  I'm pretty sure it would not have an effect.Share"


Question: Why are my Amazon Forecast results based on location inaccurate?

"We get excellent results when we run separate Amazon Forecast analysis for two different data sets  (for different cities). However, when we merge the two data sets and add a location as a new dimension in the target data set, the results aren't accurate anymore. What's the reason for this inaccuracy? We added the location as categorical (string) data. Should we add the location as one-hot encoding data?FollowComment"

Answer: "0Accepted AnswerThe inaccurate Amazon Forecast results might be because of the following: When you process the data for each city individually, Amazon Forecast builds a model for the first city, another model for the second city, and so on. When you process the merged data, Amazon Forecast builds a single model rather than minimizing the forecasting errors across both cities. If the data that's merged is very different, the merging might produce an "average" model. This explanation is oversimplified. However, understanding the statistical distribution of the used data might be critical to determine whether a global model can be applied to all cities or individual models are mandatory to get proper predictions.This is an example of a usual debate between "one global model for every situation" vs. "N specific models for each situation".  This issue doesn't have a one-size-fits-all solution.CommentShareMichael Hoarauanswered 3 years ago"


Question: Website works through &amp;amp;amp;lt;static_ip&amp;amp;amp;gt;:&amp;amp;amp;lt;port&amp;amp;amp;gt; but cannot figure out how to point

"Hello,I am using AWS LightSail with my website written using Python's Flask. The website itself works on my own machine and when I connect directly to <static_ip>:<port>. Going to <my_website>.com displays "’s server IP address could not be found."The goal: Access the website through <my_website>.comTo achieve this, I put the four name servers into the custom DNS on namecheap.com. In LightSail DNS, I have A record set as @.<my_website>.com. I fiddled with these things recently, so this might be an issue.I start my website through: gunicorn --bind 0.0.0.0:8000 wsgi:appA lot of tutorials discuss nginx as a proxy server but I am not entirely sure if that's relevant. I believe it's simply to remove external access to the web app.However, in  https://blog.miguelgrinberg.com/post/the-flask-mega-tutorial-part-xvii-deployment-on-linux , he uses Nginx with ports 80 and 443, so I am a bit confused.It is not entirely clear to me if Nginx is used for this and if so, how to adjust the config files to enable my use case.It is also not clearly to me how I would even go about debugging this.Edit:I should add I have the instance, static ip, dns zone and a distribution. Though I suppose that's obvious from what I've written.Edited by: jgybpe on Mar 4, 2021 12:51 PMEdit:Solved it by abandoning LightSail and going at it directly. This video helped:https://www.youtube.com/watch?v=VedY6EjOBWMEdited by: jgybpe on Mar 6, 2021 5:31 AMFollowComment"

Answer: 0See my edit. Helpful video: https://www.youtube.com/watch?v=VedY6EjOBWMCommentSharejgybpeanswered 2 years ago


Question: How to reinstall ubuntu 18.04 on same instance?

"Hello,I want to start fresh on the same server ip as before. current configuration has some issues, so is there any way where i can keep my backup folder saved and reinstall ubuntu on the same?Thanks.FollowComment"

Answer: "0I would suggest you ...Create a new instanceTransfer the data from the old instance to the new one.Detach the static IP from the old instancedAttach the static IP to the new instancedavidCommentShareDavid Ganswered 4 years ago0Thanks for reply & help david.I did not create static ip for the instance before. I was just using the given public ip.any way to retain that now or i should just go for the new instance?CommentSharenumberekanswered 4 years ago0You won't be able to take the instances current IP on a new instance unless it's static.You might want to try assigning a static IP to the current instance and MAYBE you'll get the current IP assigned as static (I'm not sure if that works).Otherwise, I would suggest just creating a new instance, transfer your data, and reconfigure the OS.CommentShareDavid Ganswered 4 years ago"


Question: Glue Role got S3 Access Denied when writing to underlying S3 data in Lake Formation

"Hello, I have an ETL workflow and keep getting S3 Access Denied when the Glue Role write a data frame to a destination S3 bucket (registered in Lake Formation).  Here is my current setup. Does Lake Formation vend credentials to the Glue Role for writing permission to S3? How to let the Glue Role write to S3 via Lake Formation?Registered a S3 bucket to Lake FormationGrant Data Location to the Glue RoleGrant Lake Formation Permissions (ALL) to the Glue RoleAttach AWSGlueServiceRole policy to the Glue RoleAttach an inline policy below to the Glue Role{    "Version": "2012-10-17",    "Statement": [        {            "Action": [                "iam:GetRole",                "iam:PassRole",                "lakeformation:GetDataAccess",                "lakeformation:GrantPermissions"            ],            "Resource": "*",            "Effect": "Allow"        },        {            "Action": "s3:*",            "Resource": [                "arn:aws:s3:::amazon-reviews-pds",                "arn:aws:s3:::amazon-reviews-pds/*"            ],            "Effect": "Allow"        }    ]}FollowComment"

Answer: "0Accepted AnswerEventually, I found out that I use incorrect writing method in this caseCorrect method: glueContext.write_dynamic_frame.from_catalogIncorrect method: glueContext.write_dynamic_frame.from_optionQuoted from docsWrites a DynamicFrame using the specified catalog database and table name.docsCommentSharehaianswered 23 days ago0Once you register a location to be managed by LakeFormation, you should not use s3 permissions to handle it since it.Now any client API trying to access that table needs to be LakeFormation away in order to be able to use the delegated access permissions, for instance DynamicFrame is able write into such table but not if you write directly to s3 or you use DataFrame.CommentShareGonzalo Herrerosanswered 23 days agohai 23 days agoThe amazon-reviews-pds bucket is data source which is a publicly available. My lake (destination bucket) permissions not written in the policy and grant permissions via Lake Formation.Actually, if both IAM and Lake Formation grants permission, the the Glue Role is still able to write to S3, but it is not best practice.Share"


Question: Websocket API error: Execution failed due to configuration error: No match for output mapping and no default output mapping configured. Endpoint Response Status Code: 200

"I have a websocket API connected to an HTTP API. $default works successfully, but $connect fails. I am configuring it without HTTP_PROXY and have the following request template:{"connection-id": "$context.connectionId","event-type": "$context.eventType"}The request makes it to by backend which then replies with a 200 status code. The response is turned into a 500 error with the above error message appearing in the access logs.Any suggestions? I've been working on this for two days and can't find an answer.Thanks.FollowComment"

Answer: "0Looks like your integration response key mappings are missing in the Integration Response tab. Take a look at this document - https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-integration-responses.html particularly the below section. Either a $default mapping has to be present or a /2\d\d/ response key has to be present for the backend return code of 200 to be mapped back in the response.**For non-proxy integrations, you must set up at least one integration response:Ideally, one of your integration responses should act as a catch-all when no explicit choice can be made. This default case is represented by setting an integration response key of $default.In all other cases, the integration response key functions as a regular expression. It should follow a format of "/expression/".For non-proxy HTTP integrations:API Gateway will attempt to match the HTTP status code of the backend response. The integration response key will function as a regular expression in this case. If a match cannot be found, then $default is chosen as the integration response.The template selection expression, as described above, functions identically. For example:/2\d\d/: Receive and transform successful responses/4\d\d/: Receive and transform bad request errors$default: Receive and transform all unexpected responsesFor current limitations of template selection expressions, see Template selection expressions.**CommentShareEXPERTIndranil Banerjee AWSanswered 9 months ago"


Question: How can we find out when were the binary logs of a MySQL RDS instance created?

"As we don't have access to the Aurora/RDS MySQL instance file system, I hoped there would be another way to know when a binary log was created so we can use mysqlbinlog utility to mine it specifically instead of going through all of them.FollowComment"

Answer: "0Hi, yeah currently I think there is no way to achieve the feature you mentioned due to the reason RDS is managed. Did a research as well, similar topic discussed from the community: https://dba.stackexchange.com/questions/223848/show-created-date-of-all-binary-logs --> For on-prem MySQL you will have filesystem access for last written time.If you want this feature to be developed, I would suggest you raise a feature request through the RDS console:Navigate to the left lower corner of the RDS console page --> Click Feedback --> For the drop down choose "Feature request".CommentShareSUPPORT ENGINEERKevin_Zanswered a year ago"


Question: Missing MSK service icon within Lambda Function 'Add Trigger' dropdown

"For any existing lambda function, if we want to create a KafkaEvent trigger, by selecting ‘Add Trigger’, the MSK service icon is not available in the dropdown.There is also another way to reproduce the issue that involves the AWS CLI command version of the above.Also, when executing an AWS CLI command to create a lambda function KafkaEvent event-mapping (trigger), we receive an error that the Kafka portion of the ARN is unsupported.  An example of the Kafka event mapping command is below:aws lambda create-event-source-mapping --event-source-arn arn:aws-us-gov:kafka:us-gov-west-1:99999999999:cluster/xxxxx-cluster-2/9a47c865-bb3a-482d-b289-0174b9ed63b5-2 --topics MSKXXXXXTopic-2 --starting-position LATEST --function-name serverless-kafka-consumer-lambda-dev-datasourceConsumingThe error received for the above command is the following:An error occurred (InvalidParameterValueException) when calling the CreateEventSourceMapping operation: Unsupported source arn : arn:aws-us-gov:kafka:us-gov-west-1:999999999999:cluster/xxxxxx-cluster-2/9a47c865-bb3a-482d-b289-0174b9ed63b5-2All of the above pertains to my employer's GOV cloud account.  However, in my personal AWS account, I do not have this problem.  I can see the MSK icon in the 'Add Trigger' dropdown.FollowComment"


Question: Cannot send Django regions to XRAY on aws

"I have a EC2 instance, with XRAY daemon installed in it. Also, policy AWSXRayDaemonWriteAccess is attached to the role.Simple Django application deployed to EC2, with default xray configuration.In the application logs I see:File "/usr/local/lib/python3.9/site-packages/botocore/httpsession.py", line 352, in send raise EndpointConnectionError(endpoint_url=request.url, error=e) botocore.exceptions.EndpointConnectionError: Could not connect to the endpoint URL: "http://127.0.0.1:2000/GetSamplingRules"I have the following configurations in django app:XRAY_RECORDER = {'AWS_XRAY_CONTEXT_MISSING': 'LOG_ERROR','AWS_XRAY_TRACING_NAME': 'My application','PLUGINS': ('EC2Plugin', 'ECSPlugin'),}Why the application fails to connect to Xray daemon?PS issuing the following command in EC2 terminal results in error:curl "http://127.0.0.1:2000/GetSamplingRules"error:<AccessDeniedException><Message>Invalid operation: null</Message></AccessDeniedException>FollowComment"

Answer: 0managed to connect through curlCommentSharevoippanswered 2 years ago


Question: AWS sign in - have account number but no email?

I have a client that has lost an employee and thus their aws login information. They have their account number. But cannot sign in. The employee's old email does not work as is not a valid account.How to rectify this and regain access. They do have their keys to that account. Just not their login.FollowComment

Answer: 0You should open a support case here: https://support.aws.amazon.com/#/contacts/aws-account-support/.CommentShareEXPERTkentradanswered a month ago


Question: AWS Step functions Api Gateway integration RequestBody.$ bug

"I have a state machine splitted in some different lambdas to complete a process. One of the steps is a call to apigateway lambda function. Previous call is a call to lambda function and in ASL language I tell to pass the object overrided by this function to the next step.When it comes to Apigateway step, PathParameters are filled ok with the jsonpath accessors but when I try to use in RequestBody the received value are always empty.I'm using golang languageState Machine"UploadFile": {"Type": "Task","Resource": "${UploadFileFunctionArn}","Retry": [{"ErrorEquals": ["States.TaskFailed"],"IntervalSeconds": 2,"MaxAttempts": 3,"BackoffRate": 2.0}],"Catch": [{"ErrorEquals": ["States.ALL"],"ResultPath": null,"Next": "Fail"}],"ResultPath": "$","Next": "UpdateTerminal"},"UpdateTerminal": {"Type": "Task","Next": "HasBeenUpdated","Resource": "${UpdateTerminalFunctionArn}","Parameters": {"ApiEndpoint": "${APIDomainName}/${APIBasePath}","Method": "POST","Stage": "${ApiStageName}","Path": "","PathParameters": {"terminalId.$": "$.terminalId"},"RequestBody.$": "$","AuthType": "NO_AUTH"},"Retry": [{"ErrorEquals": ["States.TaskFailed"],"IntervalSeconds": 2,"MaxAttempts": 3,"BackoffRate": 2.0}]},Update terminal lambda logs :fmt.Println("request.Body", request.Body)fmt.Println("request.PathParameters['terminalId']", request.PathParameters["terminalId"])2020-12-07T13:55:23.889+01:00request.Body  2020-12-07T13:55:23.889+01:00request.PathParameters\['terminalId'] dc725a3a-0b96-4b14-8036-5c36514466556  Edited by: eguzkilorebeltza on Dec 7, 2020 5:08 AMFollowComment"

Answer: "0I could solve this isuse after so many different tries. In golang I found that you have to specify in Parameters object Body field not as documentation says RequestBody"Body.$": "States.JsonToString($)",    "UpdateTerminal": {          "Type": "Task",          "Next": "HasBeenUpdated",          "Resource": "${UpdateTerminalApiFunctionArn}",          "Parameters": {              "ApiEndpoint": "${APIDomainName}/${APIBasePath}",              "Method": "POST",              "Stage": "${ApiStageName}",              "Path": "",              "PathParameters": {                  "terminalId.$": "$.terminalId"              },              **"Body.$": "States.JsonToString($)",**              "AuthType": "NO_AUTH"          },          "Retry": \[              {                  "ErrorEquals": \[                      "States.TaskFailed"                  ],                  "IntervalSeconds": 2,                  "MaxAttempts": 3,                  "BackoffRate": 2.0              }          ]      },CommentShareeguzkilorebeltzaanswered 2 years ago"


Question: AWS DMS Replication Task Stopped Logging

"I have been searching for the culprit. Everything from the article below seems in place, however, I can't get DMS Migration Tasks to create a group and log events to Cloudwatch. This has been working perfectly for a long time and recently stopped after a renaming effort.https://aws.amazon.com/premiumsupport/knowledge-center/dms-cloudwatch-logs-not-appearing/Is there anywhere I can look to see why the log group creation failed or to verify it is a permission issue for sanity?Here are the task settings for each task where logging is enabled:{    "Logging": {        "EnableLogging": true,        "EnableLogContext": false,Here is a dms granted IAM Role:Here is the role above's policy attachment:FollowComment"

Answer: "2Accepted Answerthe IAM role needs to named as dms-cloudwatch-logs-role explicitlyDMS task logging wont work if the role name is not dms-cloudwatch-logs-roleCommentShareAWS-User-8174525-subhashanswered 3 months agoRoss Bush 3 months agoOh, wow! I did not see that as a mandatory requirement. Thanks for the quick answer on this!ShareRoss Bush a month agoActually, it seems to work if the name *starts with dms-cloudwatch-logs-role.Share"


Question: How to allow clients to write to an S3 bucket only if the bucket is in a specific AWS account?

"These are the general formats for Amazon Resource Names (ARNs):arn:partition:service:region:account-id:resource-idarn:partition:service:region:account-id:resource-type/resource-idarn:partition:service:region:account-id:resource-type:resource-id[https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html][1]The challenge with S3:S3 buckets are globally unique (well, if we exclude Gov Cloud and China regions). That is why S3 ARNs do not include region and  the AWS account ID:arn:aws:s3:::examplebucketNow, what the customer is saying:we own a bucketwe write a policy allowing service X to write secret file Y to the bucketwe delete the bucket (and its contents), forgetting about service Xsomeone else creates a bucket and allows anybody to write to itservice X writes to "the bucket" (now owned by someone else)It would be trivial to avoid by only allowing service X to write to "bucket foo" in a particular account, but AWS IAM explicitly disallows bucket ARNs with account IDs in them.Is there any workaround for this?FollowComment"

Answer: 0Accepted AnswerThe functionality that helps with validating bucket owner has been recently released:https://aws.amazon.com/about-aws/whats-new/2020/09/amazon-s3-bucket-owner-condition-helps-validate-correct-bucket-ownership/Bucket Owner condition:https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-owner-condition.htmlCommentShareEvgeny_Manswered 3 years ago


Question: AWS SAM Layer makes too many versions

"I have noticed that SAM is producing a new layer each time we deploy, even though the contents of the layer should be bit-for-bit identical. Creating a new layer and deleting the old one takes time, so this slows down our deployments.Consider this Makefile:build-KnexNodeModulesLayer:mkdir -p "$(ARTIFACTS_DIR)/nodejs/"npm install --prefix "$(ARTIFACTS_DIR)/nodejs/" pg@8.7.3 knex@1.0.1# Flatten timestamps to avoid false change detectionfind "$(ARTIFACTS_DIR)" | xargs touch -am -h -d 2019-02-11T05:09:12If we then sam build, and run find .aws-sam/build/KnexNodeModulesLayer/ -newermt "2019-02-12", we can see that all files, directories, and symlinks have the expected timestamp. However, running sam deploy two times create two different versions of this layer.I downloaded these layers, and found that all files and symlinks have the expected timestamp from our touch command, but directories have the current timestamp:❯ stat -c "%w %y %F %n" {a,b}/nodejs/node_modules/pg{,/LICENSE}2022-03-15 12:28:10.681528449 -0400 2022-03-15 12:28:10.682330405 -0400 directory a/nodejs/node_modules/pg2019-02-11 05:09:12.000000000 -0500 2019-02-11 05:09:12.000000000 -0500 regular file a/nodejs/node_modules/pg/LICENSE2022-03-15 12:56:14.010637090 -0400 2022-03-15 12:56:14.011286674 -0400 directory b/nodejs/node_modules/pg2019-02-11 05:09:12.000000000 -0500 2019-02-11 05:09:12.000000000 -0500 regular file b/nodejs/node_modules/pg/LICENSEIt seems like the process of creating the zip file is introducing this difference, and should be considered a bug.FollowComment"

Answer: "0Wonder if the SHAs are different. Have you tried building with the -c flag and see if that helps? sam build -c -p, the -c uses cached copies of previous builds.CommentSharemithun_daaanswered a year agoJacob Elder a year agoYes, the SHAs are different. This is because each time sam build creates the zip file, it introduces a different timestamp on the directories (current time, rather than the timestamp that the directory has on the filesystem).Share"


Question: deployed zeppelin notebook not working.

"so I have 2 streams and I am merging them and then I am putting them in 1 stream which is named join which is connected to a delivery stream, when I am running the specific code manually on aws zeppelin it's working, but my data is deposited in s3but when I deploy the zeppelin notebook I am not getting any data in s3.the deployed notebook has full access s3, kinesis, and firehose access but still nothingand I cannot make anything out of the Cloudwatch.FollowComment"


Question: ec2 won't respond after stopping

"Hi there,Could someone please help advise.I stopped my instance of an EC2. Now I have started it up again and it does not seem to respond.I cant reach the website hosted on the instance and I cant access the public IP.Does anyone have an idea of what could be the issue?FollowComment"

Answer: "0Accepted AnswerDid you assign an elasitc IP to the instance?  If not then on restart it will have been assigned a different IP.Go to the console and check what the status of the instance is, and see if the Public IP has changed.  Check the documentation for instructions on assigning an elastic IP: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.htmlCommentShareguytz72answered 2 years ago0Yes this was my issue.I had to assign an Elastic IP to my instance so it would be statically assigned and my DNS would be pointing to the correct place.CommentShareJoziPanswered 2 years ago"


Question: ELB Pre-warm feature

Any material on ELB pre-warm? What does it do in addition to allowing 10x or more traffic? Any impact on the back-end like ASG?FollowComment

Answer: "0https://aws.amazon.com/articles/best-practices-in-evaluating-elastic-load-balancing/?sc_channel=sm&sc_campaign=Support&sc_publisher=TWITTER&sc_country=global&sc_geo=GLOBAL&sc_outcome=AWS%20Support&sc_content=Support&trk=Support&linkId=193246211#pre-warmingCommentSharerePost-User-0842979answered 6 months agorePost-User-6305996 6 months agoWhat will be the correct answer for this question?SharerePost-User-6305996 6 months agoYour application currently leverages AWS Auto Scaling to grow and shrink as load Increases/ decreases and has been performing well. Your marketing team expects a steady ramp up in traffic to follow an upcoming campaign that will result in a 20x growth in traffic over 4 weeks. Your forecast for the approximate number of Amazon EC2 instances necessary to meet the peak demand is 175.What should you do to avoid potential service disruptions during the ramp up in traffic? A.  Ensure that you have pre-allocated 175 Elastic IP addresses so that each server will be able to obtain one as it launches B.  Check the service limits in Trusted Advisor and adjust as necessary so the forecasted count remains within limits. C.  Change your Auto Scaling configuration to set a desired capacity of 175 prior to the launch of the marketing campaign D.  Pre-warm your Elastic Load Balancer to match the requests per second anticipated during peak demand prior to the marketing campaignShare0I could be wrong here, but I thought pre-warming ELB's is no longer required. Can you cite any AWS documentation?CommentShareptaderanswered 6 months agorePost-User-0842979 6 months agohttps://aws.amazon.com/articles/best-practices-in-evaluating-elastic-load-balancing/?sc_channel=sm&sc_campaign=Support&sc_publisher=TWITTER&sc_country=global&sc_geo=GLOBAL&sc_outcome=AWS%20Support&sc_content=Support&trk=Support&linkId=193246211#pre-warmingShare0Yes, that is correct.Any official reference stating that with ALB pre-warming "Elastic Load Balancing scales your load balancer as traffic changes over time."? Scales out up to what max instances?CommentSharerePost-User-6305996answered 6 months agoChris Pollard 6 months agoAs ALB is a managed service, the exact way in which it scales behind the scenes is an implementation detail that AWS managers on your behalf.This does not affect EC2 instances behind the ALB in an autoscaling group, as an example.Share0ELB will scale out - will send a request to ASG to add instance? How can the ALB add instances? Doesn't it make the ASG irrelevant, if the ALB add instances in this case?CommentSharerePost-User-6305996answered 6 months agoChris Pollard 6 months agoALB pre-warming scales the ALB, not the ASG or anything the ALB sends traffic to. If you're going to need ALB pre-warming, you also need to manage the ASG behind that ALB to make sure it can handle the traffic volume you're expecting.Share0What does it do in addition to allowing 10x or more traffic? Any impact on the back-end like ASG?CommentSharerePost-User-0842979answered 6 months ago0Can you help me understand your use case for ALB pre-warming? As an example, are you expecting a flash of traffic at a certain time (such as may be experienced when launching a brand new product at a marquee event that you believe will drive significantly more traffic than your site currently handles with very little ramp up). Elastic Load Balancing scales your load balancer as traffic changes over time. For the vast majority of workloads, the scaling offered by ALBs can handle increases in traffic.CommentShareChris Pollardanswered 6 months ago0What will be the correct answer for this question?Your application currently leverages AWS Auto Scaling to grow and shrink as load Increases/ decreases and has been performing well. Your marketing team expects a steady ramp up in traffic to follow an upcoming campaign that will result in a 20x growth in traffic over 4 weeks. Your forecast for the approximate number of Amazon EC2 instances necessary to meet the peak demand is 175.What should you do to avoid potential service disruptions during the ramp up in traffic? A.  Ensure that you have pre-allocated 175 Elastic IP addresses so that each server will be able to obtain one as it launches B.  Check the service limits in Trusted Advisor and adjust as necessary so the forecasted count remains within limits. C.  Change your Auto Scaling configuration to set a desired capacity of 175 prior to the launch of the marketing campaign D.  Pre-warm your Elastic Load Balancer to match the requests per second anticipated during peak demand prior to the marketing campaignCommentSharerePost-User-6305996answered 6 months ago"


Question: Sudden EventBridge rule triggers from aws.health

"I've had a EventBridge rule setup to trigger and send a notification any time there's a health event related to our account.  This has worked great and typically only get the occasional AWS notice.However as of a couple hours ago, I've started getting constant triggers from aws.health any time I visit a console page.The trigger itself is from CloudTrail and the name is "DescribeEventAggregates".  This event has not been seen in CloudTrail before, until now.FollowCommentrePost-User-2404461 2 months agoI am having the exact same issue as you. Not sure why it is happening yet though. Please let me know if you find out what why it was happening. I'll let you know if I find anything. Thanks.Share"

Answer: "2Accepted AnswerI've just experienced the same thing, so I have updated my rule to be more granular. This resolved the issue.{  "source": ["aws.health"],  "detail-type": ["AWS Health Event", "AWS Health Abuse Event"]}CommentShareMDanswered 2 months ago1Please refer to health event earlier today. https://health.aws.amazon.com/health/status[RESOLVED] Duplicate Health notificationsApr 05 2:06 PM PDT Beginning at 10:04 AM PDT, some customers began receiving notifications from the AWS Health Service and Amazon GuardDuty. These notifications may have been delivered via email or EventBridge Events. The root cause of this issue was a recent change to how EventBridge processes events. The team was able to confirm the root cause and began working on mitigating the issue by rolling back this recent change. At 1:53 PM PDT, we had fully mitigated the issue. During this time, all AWS Services were operating normally, though some customers may have been receiving notifications from previously communicated events. The issue has been resolved.Apr 05 1:46 PM PDT We have identified the root cause as a recent change to how EventBridge processes Events. We are rolling back this recent change, which will mitigate the impact of receiving duplication notifications. We will continue to provide updates as our recovery progresses. Our current expectation is full recovery within an hour.Apr 05 1:05 PM PDT We continue to investigate duplicate notifications that are being delivered by the AWS Health Service. During this time, customers may be receiving notifications via email, or Cloudwatch Events for previously communicated issues. Customers will not see additional events listed in their AWS Health Dashboard. Additionally, we'd like to clarify that there is currently no active impact to any of the AWS Services; all services are operating normally. We are working to mitigate the issue and identify the root cause of the duplicate notifications. We will provide an update within the next 30 minutes.Apr 05 12:39 PM PDT We are investigating duplicate notifications being delivered from the AWS Health Service.CommentShareRK_Sanswered 2 months ago"


Question: AWS Cognito bug - username email alias not changing after changing email

"It looks like I found a bug in AWS Cognito, and described everything in the bug report of the AWS SDK repository https://github.com/aws/aws-sdk-js/issues/4308, but no one came across.Advise how to solve the problem?FollowComment"


Question: How to push multi-arch docker image built with docker-compose to ECR

"I want to dockerize and push my node app in development to a free tier ec2 instance. Unfortunately, they are all x86 instances and my computer is an arm based chip (M1 Apple silicon). I am using a docker-compose.yml file to build my container and also pull other dependent containers from docker hub (redis & postgres). I can't figure out a way to build the docker image to be multi arch with docker buildx, use the docker-compose file and push the generated image to ECR. And as a result of the other containers being pulled, how would that work with ECR, does that mean that the redis and postgres containers will also be pushed to ECR. Is there a better way to achieve this?FollowCommentJuan_P a year agoHave you tried docker buildx bake -f <dockerComposeFile> ... ?  https://docs.docker.com/engine/reference/commandline/buildx_bake/   It even allows you to set the target platform within you compose file with a special x-bake tagShare"

Answer: "0Have you seen this? https://aws.amazon.com/blogs/containers/introducing-multi-architecture-container-images-for-amazon-ecr/ . Does it help?CommentShareEXPERTmreferreanswered a year agoInfinityString a year agoYh. I have seen that. It didn't help for my particular case. I am able to push a multi-arch image to ecr with buildx no problem. The issue arises when i try to build using a docker-compose file. If you look at the question properly, you'll understand.Share0We have good blog covering multi-arch images with ECR. Have you checked that?https://aws.amazon.com/blogs/containers/introducing-multi-architecture-container-images-for-amazon-ecr/As for free tier, ARM instances also have free tier, for example t4gCommentSharePetro_Kanswered a year agoInfinityString a year agoYes i have. Doesn't solve my particular use case. Or at least i can't find a solution from thatShare0I do multi-arch builds regularly, although not locally in that way (even though I do have arm and x86 machines). I use AWS CodeBuild which is insanely cheap for that.See this blog post for logical explanations and these repositories for practical exampleshttps://github.com/compose-x/corretto-dockerhttps://github.com/compose-x/docker-pythonCommentShareJohnPrestonanswered a year ago"


Question: An error occurred (MissingParameter) when calling the DescribeInstances operation: The request must contain the parameter AWSAccessKeyId.

"I am trying to run a shell script to launch an ec2 instance, the properties for which are defined in the script. while running the script I get the below error. "An error occurred (MissingParameter) when calling the DescribeInstances operation: The request must contain the parameter AWSAccessKeyId."FollowComment"

Answer: "1Before executing AWS CLI commands, you need to configure your AWS credentials. This typically involves setting up an IAM user with the necessary permissions and then configuring your local environment with the IAM user's credentials.to do thisif you have not any user create an IAM user (During the process of creating the user, you will be provided with an Access Key ID and Secret Access Key.)Open your terminal and run aws configure. You'll be prompted to enter your AWS Access Key ID and AWS Secret Access Key, which you obtained from the previous step. You'll also be asked to specify a default region name (for example, us-west-2) and a default output format (for example, json).AWS Access Key ID [None]: YOUR_ACCESS_KEYAWS Secret Access Key [None]: YOUR_SECRET_KEYDefault region name [None]: us-west-2Default output format [None]: jsonCommentShareEXPERTsedat_salmananswered 10 days ago"


Question: Set a cloudwatch alarm for 2 days

"Hi team, I am trying to setup an alarm over two days, I am getting this errorMetrics cannot be checked across more than a day (EvaluationPeriods * Period must be <= 86400)There is no way around this, if you adust the period to be 6 hours and evaluation to be 5 it exceeds the threshold, and vise versa.Any alternative or approaches?FollowComment"

Answer: "0Hi,indeed CloudWatch alarms don't allow more than 1 day evaluation periods at this time.Can you please elaborate on the use case? Depending on what kind of check you are trying to set, it would help contributors of repost to understand the use case in order to suggest alternatives.CommentShareJscanswered 2 months agorePost-User-0578500 2 months agoI am expecting some files to be dropped into s3 bucket, want to alarm if the files didn't make it to s3 more than 36 hours.Share0Unfortunately, you can't directly set up an alarm that checks metrics across more than one day.but there are some workarounds you can useUse AWS Lambda and Amazon SNS: You can create a scheduled AWS Lambda function that queries your metric data with a larger time window, then evaluates the condition you want to check, and sends a notification using Amazon SNS if the condition is met. This way, you can bypass the limitations of CloudWatch Alarms and create your own alarm mechanism with more flexibility.import boto3import datetimedef lambda_handler(event, context):    cloudwatch = boto3.client('cloudwatch')    sns = boto3.client('sns')        metric_name = 'YourMetricName'    namespace = 'YourNamespace'    start_time = datetime.datetime.utcnow() - datetime.timedelta(days=2)    end_time = datetime.datetime.utcnow()    period = 21600  # 6 hours    statistic = 'SampleStatistic'  # e.g., 'Average', 'Sum', 'Minimum', 'Maximum'    threshold = 100  # Set your threshold value    sns_topic_arn = 'arn:aws:sns:REGION:ACCOUNT_ID:TopicName'    response = cloudwatch.get_metric_data(        MetricDataQueries=[            {                'Id': 'm1',                'MetricStat': {                    'Metric': {                        'Namespace': namespace,                        'MetricName': metric_name,                    },                    'Period': period,                    'Stat': statistic                },                'ReturnData': True            }        ],        StartTime=start_time,        EndTime=end_time    )        metric_data_points = response['MetricDataResults'][0]['Values']    # Custom alarm condition    alarm_triggered = any(value > threshold for value in metric_data_points)    if alarm_triggered:        sns.publish(            TopicArn=sns_topic_arn,            Message=f'Alarm triggered: {metric_name} exceeded the threshold of {threshold} during the last 2 days.',            Subject='Custom Alarm Notification'        )or you can create custom metrics that aggregate your data into larger time intervalsCommentShareEXPERTsedat_salmananswered 2 months ago"


Question: Request for new tag or topic:  HPC

"Tag Name – HPCTag Definition – Questions about high-performance computing (HPC) on AWSTag Information – HPC on AWS covers technical topics around Parallel Cluster, MPI, HDF5, and applications running tightly coupled application codes.NOTE:  There is a similar 'High Performance Compute' tag, but that has a different focus and doesn't seem to represent the same kinds of questions.   'HPC' is the accepted term in the high-performance computing/supercomputing community.FollowComment"

Answer: "0Quincey_K, I will contact you offline about this request.CommentShareSUPPORT ENGINEERMonica_Lluisanswered a year ago"


Question: "Custom domain cert + cloudfront + s3 origin, https://www.ex.com/ acc denied"

"I'm using a static s3 website for origin, cloudfront and a certificate deployed to cloudfront. Having an issue:https://www.mydomain.com/index.html loads just fine.https://www.mydomain.com/ gives error:<error>  AccessDenied  <message>Access Denied</message>  ...  </error>  Same thing happens when I request the xxxxxxxxxx.cloudfront.net domain directly: /index.html works, / does not.How do I fix this? I've tried everything I can think of. Is there an S3 bucket configuration I'm missing?Edit 1: http://www.mydomain.com/ (no "s") gives access denied. /index.html redirects to https and succeeds.Edit 2: http://www.mydomain.com.s3-website-us-east-1.amazonaws.com/ (note, no "s") loads just fine.Edit 3: both http:///www.mydomain.com.s3.amazonaws.com/ and https give access denied.Edited by: Cyrus on Oct 10, 2019 12:47 PMEdited by: Cyrus on Oct 10, 2019 12:49 PMEdited by: Cyrus on Oct 10, 2019 12:50 PMFollowComment"

Answer: "0Edit: I figured it out. There is a kind of magical combination you have to put together to get this right. Here's mine:Create a brand new S3 bucket with default (closed-off) permissions or remove all public access from the target bucket.Disable static website hosting. You don't need it.If you haven't already, get your SSL cert into Amazon so you can attach it to the cloudfront distribution which will be pointing to your S3 bucket.Create a cloudfront distribution pointing to the target S3 bucket, utilizing the cert.For the origin configuration, use the www.yourdomain.com.s3.amazonaws.com form for the origin, NOT the static website hosting URL (which should be disabled anyway).Let the cloudfront config automatically change the S3 bucket access ("restrict bucket access"). You want access to the bucket restricted to this cloudfront distribution ONLY (via a specific identity). No one should be hitting your S3 bucket directly, especially since it can serve via http (no "s").Under the cloudfront "general" tab (or during setup) set your default root object to "index.html" or whatever. Otherwise, requests to https://www.yourdomain.com/ will show permission denied.While doing all this, keep in mind that cloudfront is trying to cache things, so what you're seeing in your browser may not reflect the latest "truth" of your setup. That is, with long cache times, i think it is possible cloudfront could still serve pages even if you've accidentally cut off access the origin bucket. I set my cache times very low while testing to make sure none of this created confusion.Edited by: Cyrus on Oct 11, 2019 6:42 AMCommentShareCyrusanswered 4 years ago0Hey there :) I would like to know if I'm on the right direction about how can I update files (changes in my blog) any time that I need. I used to make it thanks a software by FTP but now I want to learn making it as a programmer, so is it possible to be done by (my website don't use cloud front):CLI AWSVisual studio code toolki awsI noticed that making it drag and drop is not possible it is not updatingWhere is the clear documentation on aws to make it?Any help would be to appreciatedCommentSharehelencanswered 4 years ago"


Question: Appstream Cost question

"could you please help us understand something related to the costs in AppStream? In a fleet if we set the maximum to 50 instances, will we pay for 50 running instances or we will pay only for the desired capacity adjusted by the scaling actions?FollowComment"

Answer: "0Accepted AnswerAs per docs, for Always-On fleet instances, "all instances that are running are charged the applicable running instance fee", however only if they are running. AWS makes best effort as stated "AppStream 2.0 monitors your fleet utilization and performs automatic adjustments to fleet capacity to meet your user demand at the lowest possible cost.".For On-Demand fleet instances, "only when the instances are used for streaming sessions. Instances in On-Demand fleets that are not being used for streaming sessions are charged a small hourly stopped instance fee".So, you are charged for running instances. for instances where there is no streaming sessions you are charged as well but the stopped instance fee instead of running (e.g. $0.025 instead of $0.10).Take a look here, it gives very good overview and great example https://aws.amazon.com/appstream2/pricing/.CommentShareAWS-User-2851372answered 3 years ago"


Question: Querying nested json arrays in Cloudtrail logs to find open security groups - Is there a better way?

"I am using Athena to query my Cloudtrail logs to find security groups that have rules that allow access to/from the internet. To achieve this, I am looking to see if any cidrIp in requestParameters.ipPermissions.items[].ipRanges.items[] equals '0.0.0.0/0' or '::/0'. I have constructed a query that does this (pasted below), but it is very lengthy. I would like to know if there is a better way to write this specific query or query nested arrays in general.WITH parent as (SELECT itemsFROM "default"."my_cloudtrail_logs"CROSS JOIN UNNEST (cast(json_extract(requestParameters,'$.ipPermissions.items') AS array(json))) AS i (items)WHERE eventname = 'AuthorizeSecurityGroupIngress'  AND eventtime >= '2021-04-06T02:00:00.000' order by eventtime desc)Select * FROM parentCROSS JOIN UNNEST (cast(json_extract(items,'$.ipRanges.items') AS array(json))) AS t (cidr_items)WHERE json_extract_scalar(cidr_items, '$.cidrIp') in ('0.0.0.0/0', '::/0')FollowComment"

Answer: "1To come at the question (finding open security groups) from another angle, have you considered AWS Config? You can create a rule which will detect security groups with open rules and flag them as non-compliant. Config also supports a SQL-like query syntax to search for resources based on their properties, relationships and compliance status. It can also work cross-account and cross-region to give you a centralised view.CommentShareEXPERTJames_Sanswered a year agoAWS-User-5446926 a year agoJames, thanks for your suggestion. It will certainly help for this specific use-case. Do you (or anyone else) also happen to know if there is a better method to query nested arrays in general in Athena?Share"


Question: Tracking changes in data in Aurora PostgreSQL

"Customer is looking for ways to track changes in their data in Aurora PostgreSQL.Traditionally they could add a date created, date_modified, username etc columns directly into each table and use it as a reference.Any suggestions of a way they could cut down on having to do this for each table and instead consume some audit/WAL logs for each row change? Or ideas on how others are tackling this use case?FollowComment"

Answer: "0Accepted AnswerWe developed the Database Activity Streams feature for this use case. It's along the lines of pgaudit, but is a managed feature of RDS/Aurora that encrypts events with the customer's key and then streams them to Kinesis. Check it out and let us know what you think!https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/DBActivityStreams.htmlhttps://aws.amazon.com/about-aws/whats-new/2019/05/amazon-aurora-with-postgresql-compatibility-supports-database-activity-streams/CommentShareAWS-User-4014941answered 3 years ago"


Question: assign lake formation tags permissions  to users

"i am trying to get give lake formation tag to user /role ,like how we give the same to the data catalogFollowComment"

Answer: "0Hi,could you please review this blog post and see if the step by step guide helps you ?If you had already go through that blog post and you are having issues, could you please provide a more specific question?hope this helpsCommentShareEXPERTFabrizio@AWSanswered 5 months ago0we are lookin for the AWS::LakeFormation::PrincipalPermissions its working with database and table i want make this withAWS::LakeFormation::PrincipalPermissionsmy vision of logic is in whihui i want to see that database and user and lf tags ina aws lake formation permisssionAWS::LakeFormation::PrincipalPermissions is worlin with databases and table when i put t the lake formation tags  is added its not workingCommentSharerePost-User-9079401answered 4 months ago"


Question: MySQL Downtime Issue

"Hi,I was experienced downtime with AWS RDS t2.medium instance for MySQL about 02:37PM to 02:41PM (UTC+8).  There was another downtime happened 2 days ago with exact same issue.I cannot find useful logs about the issue.  From the CloudWatch metrics in period of 1 Minute, I found during the downtime period, there are missing data for metrics like Freeable Memory, Write IOPS, Read IOPS, Queue Depth, Write Throughput, Read Throughput, Swap usage, etc.The most obvious changes on the metrics was Swap Usage, from 02:37PM with 132.867MB jump to 02:41PM with 224.016MB.  While 02:38PM to 02:40PM data are missing.Recently I change table from MyISAM engine to InnoDB engine 3 days ago due to table level lock issue.The CloudWatch showingBefore changes:Freeable Memory around 1GBAfter changes:Freeable Memory around 100MBIs this the sign that I should go for higher instance, or possible other solution like parameter group adjustment, or OPTIMIZE TABLE after change of Database engine can solve them?Classdb.t2.mediumRegion & AZap-southeast-1aFollowComment"

Answer: "0Accepted AnswerIt sounds like you are short on memory. You can resize the innodb-buffer-pool-size to something lower than the default.When you switched to innodb, you started using the buffer pool more than before, the swapping is evidence that you ran out of memory.-PhilCommentShareMODERATORphilawsanswered 4 years ago0Thanks Phil!These 2 days I focus on trying lower down the default innodb_buffer_pool_size to 2.5GB and 2GB.  The server seems more stable than before.  Default was 3GB, but when the issue happening I already lower down to 2.75GB.  During my research online, I always saw that should not make changes on the RDS default parameter group.  It seems in my case it need adjustment to lower down the memory usage to make server stable.Thanks again for pointing out and confirming the direction!CommentShareraymondooianswered 4 years ago"


Question: Response Mapping for Join Queries?

"If I have a resolver that is an SQL query (on an RDS database via the Data API) that has a join on it, how do I map the response to the query to the 2 types in the schema?type Book {  author: Author!  title: String!  etc}type Author {  name: String  etc}and the resolver SQL query looks likeselect * from books left outer join authors on (book.author_id = authors.idIt seems like such a common thing to do I'm sure I'm missing something obvious but also I'm surprised there isn't an example in the documentation.FollowComment"


Question: "REST PUT request 'body' ignored, only path parameter is passed when I request via curl"

"Hello,I configured API gateway & lambda function to update one of my dynamodb table.Completed testing with API gateway menu, so also tried with curl, but it fail.Checked cloud watch log, I only can see path parameter, body is not passed correctly.How can I fix it? As I know, PUT request could have body to update database table attribute value, but it's not in my case.I also configured 'use lambda proxy integration' option in 'integration request'.For better understanding, I also add my configuration in below.Resource/card/{card_no}GETDELETEPUT <-- this is the problemtested by API gateway test clientINIT_START Runtime Version: python:3.9.v16Runtime Version ARN: xxxxSTART RequestId: xxxx Version: $LATESTEvent:{"resource": "/card/{card_no}","path": "/card/1","httpMethod": "PUT","headers": null,"multiValueHeaders": null,"queryStringParameters": null,"multiValueQueryStringParameters": null,"pathParameters": {    "card_no": "1"},..."body": "{\n    \"card_no\": 1,\n    \"nickname\": \"name\",\n    \"overall_type\": \"type\"\n}","isBase64Encoded": false}END RequestId: xxxxREPORT RequestId: xxxxDuration: 1322.79 msBilled Duration: 1323 msMemory Size: 128 MBMax Memory Used: 66 MBInit Duration: 236.32 mstested by curlcurl -v -X PUT \'https://xxxx.amazonaws.com/dev/card/1' \-H 'content-type: application/json' \-d '{"card_no": 1,"nickname": "nickname","overall_type": "type"}'Trying xxx..Connected to xxxx (xxxx) port 443 (#0)ALPN: offers h2ALPN: offers http/1.1....Using HTTP2, server supports multiplexingCopying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0h2h3 [:method: PUT]h2h3 [:path: /dev/card/1]h2h3 [:scheme: https]h2h3 [:authority: xxxx.amazonaws.com]h2h3 [user-agent: curl/7.86.0]h2h3 [accept: /]h2h3 [content-type: application/json]h2h3 [content-length: 60]Using Stream ID: 1 (easy handle 0x14180c600)PUT /dev/card/1 HTTP/2Host: xxxx.amazonaws.comuser-agent: curl/7.86.0accept: /content-type: application/jsoncontent-length: 60Connection state changed (MAX_CONCURRENT_STREAMS == 128)!We are completely uploaded and fineHTTP/2 200date: xxxcontent-type: application/jsoncontent-length: 220x-amzn-requestid: xxxxx-amz-apigw-id: xxxxx-amzn-trace-id: Root=xxxxConnection #0 to host 3pjqiu4m22.execute-api.ap-northeast-2.amazonaws.com left intact{"errorMessage": "'body'", "errorType": "KeyError", "requestId": "xxxx", "stackTrace": ["  File "/var/task/index.py", line 12, in handler\n    body_input = json.loads(event['body'])\n"]}%cloud watch log when I send curlINIT_START Runtime Version: python:3.9.v16Runtime Version ARN: xxxxSTART RequestId: xxxx Version: $LATESTEvent:{"card_no": 1} ==> strange point, I added print in my python code to see all the request, but only path parameter passed, can't see body...[ERROR] KeyError: 'body'Traceback (most recent call last):File "/var/task/index.py", line 12, in handlerbody_input = json.loads(event['body'])END RequestId: xxxxREPORT RequestId: xxxxDuration: 1024.82 msBilled Duration: 1025 msMemory Size: 128 MBMax Memory Used: 64 MBInit Duration: 226.62 mslambda codeimport jsonimport boto3def handler(event, context) :  print("Event: %s" % json.dumps(event))  client = boto3.resource('dynamodb')  table = client.Table('CardInfo')  body_input = json.loads(event['body'])    response = table.update_item(      xxx...xxx    },    ReturnValues="UPDATED_NEW"  )  return {    'statusCode': response['ResponseMetadata']['HTTPStatusCode'],    'body': json.dumps(response['Attributes'], default=str)  }FollowComment"

Answer: "0On the stage, can you enable Full Logs to see the payload that is being submitted into the API?  If it's working in the console but not in cURL something seems off on the cURL command but I don't see anything at first pass.Post what the full logs generate in CloudWatch when calling from cURL.CommentSharebpyleanswered 3 months ago"


Question: Does Amazon EC2 create VMs with Scientific Linux 6.x?

I am trying to determine if EC2 will let me create a VM with the OS Scientific Linux 6.x. I cannot seem to find an instance with that OS when creating one in the EC2 management console.FollowComment

Answer: "0Hello @DE-Dan_ProfCurrently Scientific Linux is not supported OS from AWS.Refer- Supported operating systemsIf the Answer is helpful, please click  Accept Answer & UPVOTE, this can be beneficial to other community members.CommentSharelearn2skillsanswered 3 months ago"


Question: API Gateway WSS Endpoint not found

"I've created a WSS chat app using the sample that comes with the AWS dotnet lambda templates. My web front end can connect ok and it creates a record in dynamo but when I try to broadcast a message to all connections I get the following error:`Name or service not known (execute-api.ap-southeast-2.amazonaws.com:443) `I'm using the following code to set it:  var protocol = "https";  //var protocol = "wss";    var domainName = request.RequestContext.DomainName;  //var domainName = "ID HERE.execute-api.ap-southeast-2.amazonaws.com";    var stage = request.RequestContext.Stage;  // var stage = "";  //var stage = "test";  //var stage = "test/@connections";    var endpoint = $"{protocol}://{domainName}/{stage}";and it logs the following:API Gateway management endpoint: https://ID HERE.execute-api.ap-southeast-2.amazonaws.com/testIve tried all the combinations and a custom domain.Im thinking that ap-southeast-2 does not support wss ? Or ... ??Been stuck on this for a while now. About ready to give up. Anyone got any ideas??Update:  Heres the code for sending the message - it just an updated version of the sample.  From the startup:  public Functions()  {    DDBClient = new AmazonDynamoDBClient();    // Grab the name of the DynamoDB from the environment variable setup in the CloudFormation template serverless.template    if (Environment.GetEnvironmentVariable(TABLE_NAME_ENV) == null)    {      throw new ArgumentException($"Missing required environment variable {TABLE_NAME_ENV}");    }    ConnectionMappingTable = Environment.GetEnvironmentVariable(TABLE_NAME_ENV) ?? "";    this.ApiGatewayManagementApiClientFactory = (Func<string, AmazonApiGatewayManagementApiClient>)((endpoint) =>    {      return new AmazonApiGatewayManagementApiClient(new AmazonApiGatewayManagementApiConfig      {        ServiceURL = endpoint,                RegionEndpoint = RegionEndpoint.APSoutheast2, // without this I get Credential errors        LogResponse = true,  // dont see anything extra with these        LogMetrics = true,        DisableLogging = false      });    });  }And the SendMessageFunction:    try    {      // Construct the API Gateway endpoint that incoming message will be broadcasted to.      var protocol = "https";      //var protocol = "wss";            var domainName = request.RequestContext.DomainName;      //var domainName = "?????.execute-api.ap-southeast-2.amazonaws.com";            var stage = request.RequestContext.Stage;      // var stage = "";      //var stage = "test";      //var stage = "test/@connections";            var endpoint = $"{protocol}://{domainName}/{stage}";            context.Logger.LogInformation($"API Gateway management endpoint: {endpoint}");            JObject message = JObject.Parse(request.Body);      context.Logger.LogInformation(request.Body);      if (!GetRecipient(message, context, out WSMessageRecipient? recipient))      {        context.Logger.LogError($"Invalid or empty WSMessageRecipient");        return new APIGatewayProxyResponse        {          StatusCode = (int)HttpStatusCode.BadRequest, Body = "Nothing to do or invalid request"        };      }            if (!GetData(message, context, out string? data))      {        context.Logger.LogError($"Invalid or empty WSSendMessage");        return new APIGatewayProxyResponse        {          StatusCode = (int)HttpStatusCode.BadRequest, Body = "Nothing to do or invalid request"        };      }      var stream = new MemoryStream(UTF8Encoding.UTF8.GetBytes(data!));            if (stream.Length == 0)      {        context.Logger.LogError($"Empty Stream");        return new APIGatewayProxyResponse        {          StatusCode = (int)HttpStatusCode.BadRequest, Body = "Empty data stream"        };      }      // List all of the current connections. In a more advanced use case the table could be used to grab a group of connection ids for a chat group.      ScanResponse scanResponse = await GetConnectionItems(recipient);      // Construct the IAmazonApiGatewayManagementApi which will be used to send the message to.      var apiClient = ApiGatewayManagementApiClientFactory(endpoint);      context.Logger.LogInformation($"Table scan of {ConnectionMappingTable} got {scanResponse.Items.Count} records.");            // Loop through all of the connections and broadcast the message out to the connections.      var count = 0;      foreach (var item in scanResponse.Items)      {        var connectionId = item[ConnectionIdField].S;        context.Logger.LogInformation($"Posting to connection {count}: {connectionId}");        var postConnectionRequest = new PostToConnectionRequest        {          ConnectionId = connectionId, Data = stream        };        try        {          stream.Position = 0;          await apiClient.PostToConnectionAsync(postConnectionRequest);          context.Logger.LogInformation($"Posted to connection {count}: {connectionId}");          count++;        }        catch (AmazonServiceException e)        {          // API Gateway returns a status of 410 GONE then the connection is no          // longer available. If this happens, delete the identifier          // from our DynamoDB table.          if (e.StatusCode == HttpStatusCode.Gone)          {            context.Logger.LogInformation($"Deleting gone connection: {connectionId}");            var ddbDeleteRequest = new DeleteItemRequest            {              TableName = ConnectionMappingTable,              Key = new Dictionary<string, AttributeValue>              {                {ConnectionIdField, new AttributeValue {S = connectionId}}              }            };            await DDBClient.DeleteItemAsync(ddbDeleteRequest);          }          else          {            context.Logger.LogError(              $"Error posting message to {connectionId}: {e.Message}");            context.Logger.LogInformation(e.StackTrace);          }        }        catch (Exception ex)        {          context.Logger.LogError($"Bugger, something fecked up: {ex.Message}");          context.Logger.LogInformation(ex.StackTrace);        }      }      return new APIGatewayProxyResponse      {        StatusCode = (int)HttpStatusCode.OK, Body = "Data sent to " + count + " connection" + (count == 1 ? "" : "s")      };    }    catch (Exception e)    {      context.Logger.LogInformation("Error Sending Message: " + e.Message);      context.Logger.LogInformation(e.StackTrace);      return new APIGatewayProxyResponse      {        StatusCode = (int)HttpStatusCode.InternalServerError, Body = $"Failed to send message: {e.Message}"      };    }FollowComment"

Answer: "0Accepted AnswerSolved it by adding the credentials when creating the Api Client.  Dont ask me why - it should be getting this from the role I thought:    this.ApiGatewayManagementApiClientFactory = (Func<string, AmazonApiGatewayManagementApiClient>)((endpoint) =>    {      AWSCredentials awsCredentials = new EnvironmentVariablesAWSCredentials();      return new AmazonApiGatewayManagementApiClient(awsCredentials, new AmazonApiGatewayManagementApiConfig      {        ServiceURL = endpoint      });    });CommentSharepetergjonesanswered a year ago0Client should connect to wss://API ID.execute-api.REGION.amazonaws.com/STAGE.When the client wants to send messages on the connection it should send requests to:https://API ID.execute-api.REGION.amazonaws.com/STAGE/@connections.As far as I know, websockets are supported there, especially if your client is able to connect.CommentShareEXPERTUrianswered a year agopetergjones a year agoI'll try that again but pretty sure I did already.  If I use a custom domain then I dont need /stage/ ??Sharepetergjones a year agoConfirmed, that doesnt work either.ShareUri EXPERTa year agoHow does your sending code looks like?Sharepetergjones a year agoUpdated.  Thanks for helping!!!Share"


Question: DataSync vmware agent port 80 still not open

"Hello,I am testing DataSync solution to migrate data from onprem to S3.After a successful test of the solution that I created manually, I wanted to automate the setup and configuration of the solution using terrafom.For that I had to delete the agent from Aws datasync console. Now when I want to activate it again I am getting an error that the agent is unreachable (agent port 80 is still closed). Could you please help me understand why port 80 is still closed  and what should I do to fix this issue? thanks in advance.FollowComment"

Answer: "0Accepted AnswerHello,Under normal conditions deleting the agent from the DataSync console will trigger the deployed agent to enter re-activation mode.  You can check by looking at the local console to determine if you can retrieve new activation key.  If it is not set for activation you could first try to reboot the agent.https://docs.aws.amazon.com/datasync/latest/userguide/local-console-vm.html#get-activation-keyIf there was an inability to communicate with the DataSync agent at the time the activated agent was deleted from the DataSync console then it is possible the agent was not sent a re-activation.  In this case it would be best to redeploy the agent.CommentShareDarryl_Dioanswered a year agorePost-User-0640858 a year agoThanks Darryl_Dio for your reply. I will try that.Share"


Question: How to perform logical OR with condition for an action in a IAM policy

"So I can't seem to find this but what I want to do is create a condition on an action in a policy based on tags.Either the tag aws:RequestTag/owner OR the tag aws:ResourceTag/owner MUST be present AND be equal to "${aws:PrincipalTag/owner}" :{    "Sid": "AllowUnlessOwnedBySomeoneElse",    "Effect": "Allow",    "Action": "*",    "Resource": "*"    "Condition": {        "StringEquals": {            'aws:RequestTag/owner': "${aws:PrincipalTag/owner}",            'aws:ResourceTag/owner': "${aws:PrincipalTag/owner}"        }    }}The problem is that as it is current written above, this says that both the aws:RequestTag/owner AND the tag aws:ResourceTag/owner tags would be present which cant be true.I need is so that at least one of those two tags is present and that they be equal to ${aws:PrincipalTag/owner} .How do I accomplish this?FollowCommentKallu a year agoAs this snippet looks somewhat familiar :-) I should comment why there is AND, not OR. Condition is to state your API request must have the same owner=value as the resource does. Original version had StringEqualsIfExists to allow those cases where owner -tag isn't present or doesn't make sense. I'm not sure what would be the use-case for OR, as your requestTag comparision will always be true if you have tagged the IAM user or role you are using?Share"

Answer: "3Accepted AnswerOne way to approach this problem could be as follows :{    "Version": "2012-10-17",    "Statement": [    {    "Effect": "Allow",    "Action": "*",    "Resource": "*",    "Condition": { "StringEquals":  'aws:RequestTag/owner': "${aws:PrincipalTag/owner}" }     },     {    "Effect": "Allow",    "Action": "*",    "Resource": "*",    "Condition": { "StringEquals":  'aws:ResourceTag/owner': "${aws:PrincipalTag/owner}" }     }     ]}You can have multiple "Allow" constructs in a single IAM statement.Either of these could allow the action.CommentShareDennis_Aanswered a year agochrisjd20 a year agoOh duh lol Why didnt I think of this.Share1Create two separate statements:{    "Sid": "AllowUnlessOwnedBySomeoneElse",    "Effect": "Allow",    "Action": "*",    "Resource": "*"    "Condition": {        "StringEquals": {            "aws:RequestTag/owner": "${aws:PrincipalTag/owner}",        }    }},{    "Sid": "AllowUnlessOwnedBySomeoneElse2",    "Effect": "Allow",    "Action": "*",    "Resource": "*"    "Condition": {        "StringEquals": {            "aws:ResourceTag/owner": "${aws:PrincipalTag/owner}"        }    }}Make sure you also have a look at the page that details which services do and don't support ABAC as well.CommentShareMattanswered a year agochrisjd20 a year agoTHanks, I should have thought of this.Share"