Question: trouble getting userinfo from id_token in Cognito

"After performing an .....amazoncognito.com/login?.... via the hosted web UI, I am correctly redirected to the callback URL with a query param "id_token" that I can use to access my API Gateway endpoints via x-api-key.I am wanting to use the ID token to get the Cognito user info associated with that token (for verifying in my API that the token will allow for access to data that should only be accessed by that user).How can I get the Cognito User ID, email etc? the ....amazoncognito.com/ouath2/userinfo seems like what i need but don't know how to correctly use that endpoint with the ID_token I have.FollowComment"

Answer: "0Hi,The ID Token is a JWT Token. The payload section of the JWT token should have the user info that you are looking for.I'd recommend checking out the following documentation and knowledge center article:Using the ID tokenHow can I decode and verify the signature of an Amazon Cognito JSON Web Token?CommentShareSUPPORT ENGINEERRyan_Aanswered a year ago"


Question: Inspector: The assessment run could not be executed at this time as there are no targeted instances available for the selected assessment template.

"I came into my company with Inspector Classic already set up and running.  Recently, the weekly run of the Inspector report has stopped and I am unable to manually run the same report.  The message, "The assessment run could not be executed at this time as there are no targeted instances available for the selected assessment template" is all I am able to get.  I have tried to create a new template, but each time I am not getting the same results.  I am very green when it comes to AWS and feel that I must be missing a large part to get the report running again.  Please assist.  Thank you in advance.FollowComment"

Answer: "0Hi,Has anything changed in your instance configurations ? i.e., Amazon Inspector classic needs agents to be installed to assess the security rules - see here: https://docs.aws.amazon.com/inspector/v1/userguide/inspector_assessments.html, and when you recreated the template, you can use the Preview Target button on the Assessment Templates page to review all EC2 instances included in the assessment target. For each EC2 instance, you can review the hostname, instance ID, IP address, and, if applicable, the status of the agent. The agent status can have the following values: HEALTHY, UNHEALTHY, and UNKNOWN. Amazon Inspector Classic displays an UNKNOWN status when it can't determine whether there is an agent running on the EC2 instance.Can you try this and find out the instance status ?CommentShareArunanswered 3 months agoSnowgo 3 months agoIf I had to assume if there were any changes, I would say yes.  Looking into the templates, I see that the agents show as unknown for a status.  I show 46 items that are in unknown status.Share"


Question: Cloud9 stuck reconnecting

"hi all, i want to ask about my cloud9 is stuck reconnecting, after install https://github.com/rdpstaff/RDPTools and i don't have any clue what's wrong with it, if all of you have same problem and solve it, please help meFollowComment"

Answer: "0Hi,Considering that cloud9 will git checkout all the repos it detects under the environment path, you might consider increase the memory of the instance behind cloud9. Check memory at AWS Cloudwatch if you are using AWS EC2.Cheers!CommentShareDavidCaballeroanswered 4 months ago"


Question: ACM domain validation: Renewal for internal or non public Load-Balancers

"A customer is using ACM managed certificates and domain validation. Their load balancers are not publicly reachable (protected by security groups, but this probably applies also to internal load balancers), but for the renewal of the certificates a HTTPS is made from ACM to the domains in the certificate:"ACM must be able to establish an HTTPS connection with each domain in the certificate."https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-renewal.htmlThe want to be able to automate the renewal process, e.g. they don't want to use email validation.I wonder why the HTTPS request is necessary at all for DNS validation and renewal  (this is in general not required with DNS validation by other certificate providers)Do we have any workaround for this? E.g. allow a defined IP range from ACM in the security groups?FollowComment"

Answer: "0Accepted AnswerAs specified in the launch blog post: https://aws.amazon.com/blogs/security/easier-certificate-validation-using-dns-with-aws-certificate-manager/ and in the DNS Public Docs: https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-validate-dns.htmlIf the customer validates a certificate using DNS:ACM automatically renews certificates that are deployed and in use with other AWS services as long as the CNAME record remains in your DNS configuration. To learn more about ACM DNS validation, see the ACM FAQs and the ACM documentation.Establishing a TLS connection to the domain will not be necessary to automatically renew DNS-Validated Certificates as long as the CNAMEs used to initially validate the domain(s) are still reachable via public DNS.Hope that helps!CommentShareAWS-User-6038472answered 5 years ago"


Question: How to get ip addresses of apigateway vpce using cdk?

"Background context / End goal:I am trying to use cdk to create a target group that consists of the ip addresses that are associated with a vpc endpoint (for apigateway) as per this AWS blog.Ideally, I would like to be able to just lookup the associated ips using just the fact that the vpce is for the service of apigateway OR potentially using the vpce id.ProblemI cannot find a way to get the network interface ids & ip addresses for the vpc endpoint.AttemptsI tried to use the cdk InterfaceVpcEndpoint construct static method using the fromInterfaceVpcEndpointAttributes (filtering by service).  It did return the desired vpce, but unfortunately it returns in the format of IInterfaceVpcEndpoint which does not have the vpceNetworkInterfaceIds attribute that the InterfaceVpcEndpoint construct hasI was able to use AwsCustomResource (after consulting a stack overflow post that referenced this example) to look up the ip addresses for a given array of vpce network interface ids:const vpceNetworkInterfaceIds = =['eniId1', 'eniId2'];const getEniIps = new AwsCustomResource(scope, `GetEndpointIps`, {          onUpdate: {            service: "EC2",            action: "describeNetworkInterfaces",            parameters: {               NetworkInterfaceIds: vpceNetworkInterfaceIds              },            physicalResourceId: PhysicalResourceId.of(Date.now().toString())          },          policy: AwsCustomResourcePolicy.fromSdkCalls({            resources: AwsCustomResourcePolicy.ANY_RESOURCE          }),        });        const privateIpAddresses: string[] = [];        for(let i = 0; i< vpceNetworkInterfaceIds.length; i++){          const privateIpAddress: string = getNetworkInterfaceIpAddresses.getResponseField(`NetworkInterfaces.${i}.PrivateIpAddress`).toString();          privateIpAddresses.push(privateIpAddress);        }        return privateIpAddresses;}I tried to make a similar sdk call (describeVpcEndpoints), but then I encountered issues retrieving the array of NetworkInterfaceIds.    const getNetworkInterfaceIpAddresses = new AwsCustomResource(scope, `GetVpceNetworkInterfaceIds`, {        onUpdate: {          service: "EC2",          action: "describeVpcEndpoints",          parameters: {             Filters: [              {                 Name: "service-name",                Values: ["com.amazonaws.us-east-1.execute-api"]              }             ]            },          physicalResourceId: PhysicalResourceId.of(Date.now().toString())        },        policy: AwsCustomResourcePolicy.fromSdkCalls({          resources: AwsCustomResourcePolicy.ANY_RESOURCE        }),      });      return getNetworkInterfaceIpAddresses.getResponseFieldReference(`VpcEndpoints.0.NetworkInterfaceIds`).toJSON();   I tried variations of using the Reference methods of toJson, toString, Token.asXXX but was not able to figure out how to get the array of values from this custom resource.One of the errors that I got was  "Vendor response doesn't contain VpcEndpoints.0.NetworkInterfaceIds key in object ....." but when I made the describeVpcEndpoints call via cli, I can definitely see that there is a VpcEndpoints.0.NetworkInterfaceIds value that should be populated.QuestionsHow can you get an array from the sdk call of a aws custom resource?How can you debug cdk aws custom resources that make sdk calls?  Logging locally only yields the tokens which is not helpful.Is there a more straight forward way to get the vpceNetworkInterfaceIds of a given vpce?Is there a more straight forward way to get the ip addresses for a given vpce?FollowComment"

Answer: "0Hello,To begin with currently there is no native way to get the Private IP address  of the ENI  that gets created when we create an Interface endpoint.  Regarding custom resources it is not possible to iterate through a list returned by a custom resource at the moment  as this require synth time logic to operate on values that aren't known until deploy time, this is an open github issue tracked by the CDK service team for disscussion-->https://github.com/aws/aws-cdk/discussions/22826Please don't hesitate to comment here if you have any follow up questionsCommentShareAditya_Tanswered 6 months ago"


Question: Logging system in AWS

"Hi AWS, how can we design the Logging system to track the unprocessed/ errored out payload? What are the dos and donts for the same?FollowComment"

Answer: "1There are several ways to design a logging system in AWS to track unprocessed or errored out payloads. One common approach is to use a combination of AWS services such as Amazon Kinesis, AWS Lambda, and Amazon S3.In terms of "dos and don'ts," some things to keep in mind include:Do ensure that your logging system is designed to handle high volumes of data and can scale as needed.Don't store sensitive data in plaintext in your logs.Do use encryption to protect your logs in transit and at rest.Don't store your logs indefinitely. Consider setting up a retention policy to automatically delete old logs after a set period of time.Do test your logging system regularly to ensure that it is working as expected and can detect and handle errors and failures.CommentShareAWS_Guyanswered 3 months ago"


Question: Get state of connection with AWS IoT in Greengrass component.

How can I get status of connection with the cloud in a custom Greengrass component?FollowComment

Answer: "1another option is to send a message to a ping/request topic to iot-core and have a lambda send a reply to the originator on a ping/response topic.i know..not a great solution, but at least you know within a configurable time that you've lost connectionCommentShareclogwoganswered a year agoOleksandrTurok a year agoI did similar solution. My component posts to a ping topic and subscribe to it at the same time. I the component doesn't get its messages I know that we lose the internet connection.Share1Hi Oleksandr,There is no official way to get the MQTT connection state in a component, though if you visit us on Github we'd be more than happy to have a technical discussion with you on that.One configuration knob that may be interesting to you is the keepQos0WhenOffline configuration option which can instruct Nucleus to drop QoS 0 MQTT messages if it is disconnected. While this doesn't directly address your question, there are a number of scenarios where it doesn't make sense to buffer messages to be sent at a later time.https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-nucleus-component.htmlThanks,-joeCommentShareJoeAtAWSanswered a year ago0Thanks for answeringThe keepQos0WhenOffline  is a good parameter and can be used in some cases.In my case, I need to indicate status of the connection on the led indicator.So I think it will be easier to check only the internet connection.CommentShareOleksandrTurokanswered a year ago"


Question: How to move data from glacier flexible to deep archive

"HeyI am trying to move my data from the glacier to the deep archive but I couldn't find any way or solution for it ....Could you help with some direction or suggestion for this method.Thank YouFollowCommentFabio_L 7 months agoIf you are trying to transition S3 objects from the S3 Glacier Flexible Retrieval storage class to the S3 Glacier Deep Archive storage class, you can use S3 Lifecycle for the transition - https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html. Please be aware that there are costs associated with the transition - https://aws.amazon.com/s3/pricing/ . If you are trying to move S3 Glacier vault archives to S3 objects stored in the S3 Glacier Deep Archive storage class, take a look at this AWS Solution called re:freezer - https://aws.amazon.com/about-aws/whats-new/2021/04/new-aws-solutions-implementation-amazon-s3-glacier-re-freezer/ShareZJon 3 months agoPlease let me know if I answered  your questionShare"

Answer: "0GreetingsTo move data from Amazon S3 Glacier to Amazon S3 Glacier Deep Archive, you can use the S3 Glacier Deep Archive Transition option. Here are the steps to do so:Create an S3 Lifecycle policy: In order to transition data from Glacier to Glacier Deep Archive, you will need to create an S3 Lifecycle policy that specifies the transition rules. You can create an S3 Lifecycle policy using the S3 Management Console, AWS CLI, or AWS SDKs.Specify the transition rule: When creating the S3 Lifecycle policy, you can specify a transition rule that automatically moves objects from Glacier to Glacier Deep Archive after a specified number of days or based on other criteria. You can also specify the minimum storage duration for Glacier Deep Archive to ensure that the data remains in the archive for the required period.Monitor the transition progress: Once the S3 Lifecycle policy is created and applied to the Glacier objects, you can monitor the transition progress using the S3 Management Console or programmatically using the AWS SDKs. The transition process may take some time depending on the size of the objects and the number of objects being transitioned.It's important to note that once the data is transitioned to Glacier Deep Archive, retrieval times may be longer than for Glacier. Therefore, it's important to consider the retrieval times and costs before transitioning data to Glacier Deep Archive.Additionally, you may want to consider creating a backup of your data before transitioning it to Glacier Deep Archive, as retrieval times can be longer and there may be additional costs associated with retrieving the data.I hope this helps! Let me know if you have any further questions.CommentShareZJonanswered 3 months ago"


Question: AWS WAF Has My ISP's IP Addresses on HostingProviderIPList - How to get them removed?

"I work at an ISP and, obviously, we use our own IP addresses both for our customers and for our own internet access. We use AWS for some things.We also provide some hosting services for a small number of websites (seriously, a small number) but the majority of our business is residential and business office internet service. Somehow AWS has decided all of our IP addresses are part of a hosting provider and they are being blocked by a lot of applications that use the AWS WAF reputation IP group HostingProviderIPList. We have heard complaints from a number of customers that they cant use certain websites or apps because of this issue. The number of IPs in use for hosting services is probably about 8 - 10% of our total IP space. The rest are all for various internet access services.I can't find any way to have them removed from the list or to modify our use or administration of the IPs to have them removed automatically. AWS general support has not yet replied to our efforts to contact them. Any ideas?FollowComment"

Answer: "1Accepted AnswerHi,For this case your team should open a ticket regarding the Managed AWS WAF Rules. If you have TAM/SA managing your account then can ask their help as well to get some guidance from the group managing the WAF list and product team how to get the ASN IP address being taken out from the list.I am not sure if you have some sort of control on the WAF configuration, and potentially to put some allow-listing using custom rule temporary. But the best approach will be via support team to handle the exemption.CommentSharewkkamaruanswered 2 months agoFrameHowitzer 2 months agoI was worried that might be the case, I'll have to see about doing that. I was hoping there would be some kind of standardized method to publish information for ingest that would mark the IPs in question as 'end user' IP addresses or something like that. We have done rDNS work and location data for the IPs but nothing seems aimed at this kind of thing. A lot of cloud providers and service/app providers seem to just do whatever they want in cases like this and seldom have a good option to fix it when it goes wrong.Share"


Question: Load S3 Bucket data into Aurora PostgreSQL tables

"I need to load my data from S3 Bucket into the Aurora PostgreSQL tables. I read https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_PostgreSQL.S3Import.html#USER_PostgreSQL.S3Import.Reference this documentation and I will try. But, do we have any other way to be able to handle this case?Especially I want to ask, Is there any LOAD command which exists on Aurora PostgreSQL?Thanks!FollowComment"

Answer: "1One option could be to use DMS.DMS does support S3 as a source - https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.S3.htmlDMS supports Aurora Postgres as a target - https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.PostgreSQL.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 10 months agoMayura 7 months agoI want to perform integrity check on my files in S3 bucket (The record count and md5 are 2 checks we need to do when files arrive in S3 from source DB). When these checks are successful, we want to load these files into Postgres.Can you please guide how this can be done? Integrity checks can be done in a bash script. Can we use the same script to copy files to Postgres?Share0The procedure for using the table_import_from_s3() function is explained here: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_PostgreSQL.S3Import.htmlYou call the function from a SELECT statement. And so you could automate that by calling psql from a shell script, and passing the SELECT statement as a -c (command) or -f (SQL script file) argument to psql.CommentShareAWS-User-0081273answered 2 months ago"


Question: AWS RDS MariaDB on Graviton 2 CPUs has no external access

I am experiencing issues with external access to MariaDB when I am running it on m6g instances. As soon as I roll back to m5 instance I have external access. Is there compatibility issues with MariaDB and graviton2 CPUs? anyone else has same problem?FollowComment


Question: EBS Volumes on RAID0 to gain perfomance

"Hi,I have to setup a Domino Server, that uses a "translog" path.  On the Domino Server documentation, it is suggested to dedicate a specific disk with his own controller to this path directory.I am not sure what method to use,   either to use a normal GP3 disk,  and add more IOPs if  I see they are needed,   or using ESB (algo GP3) on Raid0.Problem that I see with Raid0 is that I do not known how easy is to increase volumes on a RAID0 Configuration.     On a normal (single) ESB volume,  starting with a "small" size of the volume  (ie, 100Gb),  and then, increase it,  is easy, is a trivial thing, and I can add also more IOPs / trhoughput on a very easy way,  so I guess I can get the same (or very similar) perfomance that I will get with RAID0.I am aware that will RAID0  I will be able to "double" the perfomance,  because I will get accumulatted IOPs values,  so the maximum of IOPs obtained on RAID0 will be always greater, but not sure if I will need to increase the IOPS to a ratio that can not be obtained also on a single GP3 Disk.    Moreover, my concern on RAID0 is about how easy will be to increase volume on it..   Can I increase a ESB volume that is being part of a RAID0 the same way that a normal EBS volume ?  Do I need to have both ESB volumes at the same size ?     Is the administrative additional task on a RAID0 woth the less (ie, complexity added for increasing volumes, for snapshoots, backups/recoverys, etc) ?In summary...   When is bettert to have a single EBS volume with the number of IOPS you need,  or a RAID0 config ?FollowComment"

Answer: "1Accepted AnswerIt is possible to configure EBS with RAID 0 in order to achieve a higher level of performance for a file system, as described here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/raid-config.htmlHowever, this does add complexity to your solution.I would personally look at the I/O rates of the different EBS volume types.  For example, io2  provisioned IOPS storage can support up to 64,000 IOPS, and io2 Block Express up to 256,000 IOPS.You are restricted to using EC2 instances that are built on the Nitro architecture, however, and  io2 Block Express only work on r5b instances.Details are here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.htmlCommentShareDennis_Aanswered a year ago1Hi Andres,To echo what Dennis mentioned, I tend to avoid using any RAID in the disk setup. Main advantage when using single disk is the simplicity when dealing with backup using Snapshots. For performance concern, io2 Block Express should be covering the high performance requirement in most of the general use cases.Hope this helps.EricCommentShareEric_Yanswered a year ago"


Question: request resolver with es...trying to limit filter results

"I have a query like this...{  "version":"2017-02-28",  "operation":"GET",  "path":"/articlesnew1/json/_search",  "params":{    "body": {      "size": 50,      "query": {        "bool": {          "should" : [          {              "exists" : {                "field" : "field_categories.__target_path"              }            },            {              "exists" : {                "field" : "field_plays.__target_path"              }            },            {              "terms" : {                "field_categories.__target_path" : ["he/taxonomy_term/categories/837","he/taxonomy_term/categories/840","he/taxonomy_term/categories/841","he/taxonomy_term/categories/842""]              }            },            {              "terms" : {                "field_plays.__target_path" : ["he/taxonomy_term/plays/757","he/taxonomy_term/plays/758""]              }            }           ],          "must_not": [            {              "term": {               "field_exclude_from_syndication.value": 1               }            }          ],          "filter": [          {              "terms": {                  "entity.bundle" : ["he_activity_highlight","he_company","he_event","he_exclusive","he_industry_voice","he_new_financing","he_news","he_opinion","he_person","he_publication","he_transaction","he_under_40","he_whos_who"]               }            },            {              "range" : {                "entity.changed.timestamp" : {                  "gte": "${context.arguments.from}",                  "lte": "${context.arguments.to}"                }              }            }          ]        }      }    }  }}But I do not want results where either "field_categories.__target_path" or "field_plays.__target_path" are not present and matching one of the values. But I am still getting results where both are empty like this..."field_categories": [],"field_plays": [],The expected results might look like this..."field_categories": [{"__target_path": "he/taxonomy_term/categories/850"}],...or this..."field_plays": [{"__target_path": "he/taxonomy_term/plays/772"}],ideas?Edited by: cjokinen on Jun 10, 2019 2:30 PMEdited by: cjokinen on Jun 10, 2019 2:31 PMEdited by: cjokinen on Jun 10, 2019 2:32 PMFollowComment"

Answer: "0UPDATE: I changed my code to what is below, but it is too restrictive and only returns records that have both the category and play flelds. I need it to return records if both or either field exist.{  "version":"2017-02-28",  "operation":"GET",  "path":"/articlesnew1/json/_search",  "params":{    "body": {      "size": 50,      "query": {        "bool": {          "should" : [            {              "terms" : {                "field_categories.__target_path" : ["he/taxonomy_term/categories/837","he/taxonomy_term/categories/840","he/taxonomy_term/categories/841","he/taxonomy_term/categories/842"]              }            },            {              "terms" : {                "field_plays.__target_path" : ["he/taxonomy_term/plays/757","he/taxonomy_term/plays/758","he/taxonomy_term/plays/759","he/taxonomy_term/plays/761","he/taxonomy_term/plays/762","he/taxonomy_term/plays/763","he/taxonomy_term/plays/764"]              }            }           ],          "must_not": [            {              "term": {               "field_exclude_from_syndication.value": 1               }            }          ],          "must": [            {              "bool": {                "should" : [{                  "exists": {                    "field" : "field_categories.__target_path"                  },                  "exists": {                    "field" : "field_plays.__target_path"                  }                }]              }            }          ],          "filter": [            {              "terms": {                  "entity.bundle" : ["he_activity_highlight","he_company","he_event","he_exclusive","he_industry_voice","he_new_financing","he_news","he_opinion","he_person","he_publication","he_transaction","he_under_40","he_whos_who"]               }            },            {              "range" : {                "entity.changed.timestamp" : {                  "gte": "${context.arguments.from}",                  "lte": "${context.arguments.to}"                }              }            }          ]        }      }    }  }}Ideas?Edited by: cjokinen on Jun 11, 2019 9:33 AMEdited by: cjokinen on Jun 11, 2019 9:34 AMCommentSharecjokinenanswered 4 years ago0I found the answer in that I missed some curly braces inside of the must section....{  "version":"2017-02-28",  "operation":"GET",  "path":"/articlesnew1/json/_search",  "params":{    "body": {      "size": 50,      "query": {        "bool": {          "should" : [            {              "terms" : {                "field_categories.__target_path" : ["he/taxonomy_term/categories/837","he/taxonomy_term/categories/840","he/taxonomy_term/categories/841","he/taxonomy_term/categories/842"]              }            },            {              "terms" : {                "field_plays.__target_path" : ["he/taxonomy_term/plays/757","he/taxonomy_term/plays/758","he/taxonomy_term/plays/759","he/taxonomy_term/plays/761","he/taxonomy_term/plays/762","he/taxonomy_term/plays/763","he/taxonomy_term/plays/764"]              }            }           ],          "must_not": [            {              "term": {               "field_exclude_from_syndication.value": 1               }            }          ],          "must": [            {              "bool": {                "should" : [{                  "exists": {                    "field" : "field_categories.__target_path"                  }                },                {                  "exists": {                    "field" : "field_plays.__target_path"                  }                }]              }            }          ],          "filter": [            {              "terms": {                  "entity.bundle" : ["he_activity_highlight","he_company","he_event","he_exclusive"]               }            },            {              "range" : {                "entity.changed.timestamp" : {                  "gte": "${context.arguments.from}",                  "lte": "${context.arguments.to}"                }              }            }          ]        }      }    }  }}Edited by: cjokinen on Jun 11, 2019 1:21 PMCommentSharecjokinenanswered 4 years ago"


Question: what services to request

"I run a wordpress website earthjay.com and want to host this site at aws. I also have about 200gb of data that are part of the website, but not part of wordpress. A colleague mentioned that I could place this on AWS S3 but I don't know what the best approach is going to be for my needs. do i have everything on lightsail, or do i put the data on S3 (?) and have the wordpress site on lightsail? i am guessing that lightsail is the best webhosting option since i am hosting only one website.my website's main purpose is to publish earthquake reports that are used internationally to help people learn and teach about earthquakes and plate tectonics. this site is not monetized and is a 100% volunteer based effort (on my part). thanks in advance for helping me learn about the best option for my usage. be well, jayFollowComment"

Answer: "1Accepted AnswerAWS LightSail is a platform as a service (PaaS) mainly targeted for web hosting with Virtual Private Servers (VPS) for lower cost. Its intended to provide a simple web user interface to Manage the Servers and basic configuration arround it. This is not recommended for highly scalable applications which utilizes Elasticity in Cloud.Amazon S3 is a great service to safely backup your data where redundancy is guaranteed and the cost is fair.Read this 3rd party article on comparisons between the 3, however it is supposed to be used only for reference.Link- https://cloudofthings.net/lightsail-vs-ec2-vs-s3-web-hosting/Please click accept answer if it helped you.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 9 months agoEXPERTChris_Greviewed 9 months agoearthjay 9 months agothank you. this helps. i will start with lightsail!Share1You should consider Amazon Lightsail  since it would really simplify your deployment and ease you into AWS. There is a guide here to help you bring up a WordPress site with very little effort as well as some documentation on how to use object storage with Amazon Lightsail. Hope this helps!CommentSharePaul Frederiksenanswered 9 months agoearthjay 9 months agothanks. your comment helped! (but i could only accept 1 answer)SharePaul Frederiksen 9 months agoYou are welcome!Share"


Question: SSL creation require additional verification to request a certificate for one or more domain names in this request. (.ru domain zone)

"SSL creation require additional verification to request a certificate for one or more domain names in request. (.ru domain zone)The error says write on the forum if I don't have a support plan.One of my projects has already been disabled and one of these days the most critical second project will be disabled.If I need to provide additional information about myself, how do I do it?In all documentation it is written that when using R53 + amplify, everything is done automatically.FollowComment"

Answer: "1Accepted AnswerHi There,I understand that you are getting an error "Additional verification required to request certificates for one or more domain names in this request." (.ru domain zone) when validating the domain name to issue the public certificate via ACM.Please note this error could be the results of one of two things.When the certificate contains a domain that ranks within the Alexa top 1000 websites.[1]Or as of March 10, 2022 ACM has restrictions to issue new certificates for ".ru" domains until further notice.I see in your case you will no longer be able to issue or renew certificates as your domain falls under the following domains..RU.BYБел - BelarusРф - Russian Federation.moscow.москва - Moscow.SU - Soviet Union(http://ru.com/) .RU.COM.РУС.RU.NETAll Amazon certificates for these domains will remain functional until expiration, but will not be renewable and no new certificates from these domains will be issued.The only workaround that would work in your scenario would be to obtain a certificate from a third party that can issue a certificate for your domain, and import the certificate into ACM [2]I trust the above information is helpful to you.References: ==============[1] https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-failed.html#failed-additional-verification-required[2] https://docs.aws.amazon.com/acm/latest/userguide/import-certificate.htmlPlease note that I personally value your feedback, please accept this answer if you find it helpful to you.CommentShareMfaneloanswered a year ago0To create a certificate for a domain, the domain must be verified as being owned by you. Ideally this is via DNS validation, where you write a CNAME record to your DNS configuration to establish you have control of your domain name. ACM (Certificate Manager) can update your DNS configuration for you if you manage your DNS records with Amazon Route 53. After you have configured the CNAME record, ACM can automatically renew DNS-validated certificates before they expire. Another option is email validation where ACM sends email to the domain's contact addresses and five common administrative addresses for the domain, i.e.administrator@your_domain_namehostmaster@your_domain_namepostmaster@your_domain_namewebmaster@your_domain_nameadmin@your_domain_nameSomeone must receive that email and click on the link in order to verify the domain.CommentShareEXPERTskinsmananswered a year ago"


Question: AWS Storage Gateway EC2 High Availability

How can High Availability be achieved when running AWS Storage Gateway on EC2 instances? The documentation mentions HA under VMware environment but no mention on EC2. Concerned on what would happen to the storage gateway service when the EC2 underlying hardware goes bad which happens often throughout our entire AWS infrastructure.FollowComment

Answer: "0Hi, HA for EC2 environment is currently not available for storage gateway. When there is an underlying EC2 hardware issue, system status checks fails for the EC2 instance. When system status checks fails, you can configure CloudWatch alarm actions to recover the EC2 instance automatically.https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/UsingAlarmActions.html#AddingRecoverActionsCommentShareSuryaanswered 7 months agoEric-9462223 7 months agoThanks for the suggestion, will definitely look at it.Share"


Question: Instance Scheduled for Retirement

"Hi,Why is my instance scheduled for retirement?ThanksMessage in console:Retiring: This instance is scheduled for retirement after May 17, 2019 at 1:00:00 AM UTC+1FollowComment"

Answer: "0Hello,I have taken the following from the below documentation:"An instance is scheduled to be retired when AWS detects irreparable failure of the underlying hardware hosting the instance. When an instance reaches its scheduled retirement date, it is stopped or terminated by AWS"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-retirement.htmlCommentShareAWS-User-8424448answered 4 years ago"


Question: Redshift column VARCHAR(MAX) question

"A customer is looking at creating a redshift table with a large varchar(65535) column (although only a tiny percentage of data will be large), but our best practice suggests that use the smallest possible column size (due to potential memory waste).They’d like to clarify:Does that mean having a varchar column with large max size will only affect performance if we store a lot of large strings in the column?Would there be any problems if say 90% of the data is only 20 bytes?I found a support article mentions that trailing blanks can occupy the full length in memory during query processing, but still not clear enough to answer the above questions.FollowComment"

Answer: "0Accepted AnswerThe impact of the wide columns is mainly when you query the data.  I.e. if the user queries others columns in the table, the wide column will not impact the query performance.  If the column is queried often,  the better approach is to parse out the pertinent piece(s) of information and load into dedicated & right-sized columns for most reporting purposes.  You can leave the raw data in the current column but advise users to avoid accessing those columns.CommentShareEXPERTRajiv_Ganswered 3 years ago"


Question: DX VLAN tagging QinQ

"Hello,We have a hosted connection on VLAN 125 and AWS Direct Connect Partner/Service provider provided the VLAN 3166.( probably qnq tagging)We have configured the vLAN 125 on our on prem router with dot1q encapsulation. However I can not ping the amazon peer ip sourcing from our peer ip which in turn fails our layer 2 test. How can I resolve this issue ?Any suggestions or guidance is highly appreciated .ThanksFollowComment"

Answer: 0Accepted AnswerSee the troubleshooting steps for DX Layer2 issues here:https://docs.aws.amazon.com/directconnect/latest/UserGuide/Troubleshooting.html#ts-layer-2If you have tried all of these and still the issue persists then suggest opening a support ticket.CommentShareEXPERTTushar_Janswered 8 days agoEXPERTBrettski-AWSreviewed 8 days ago


Question: RDS for Oracle: Bring Your Own License with No License

"I have created an RDS for Oracle databases solely for personal learning purposes. No any intention for production/profit/business purposes, and I am the only person who has access to the database.Can I use the BYOL model without facing any license violations?FollowComment"

Answer: "1Accepted AnswerHello,I see that you wanted to know of any license violation which using BYOL for Oracle on RDS.I would suggest you to check with Oracle for this query as they would issue you the license.From AWS standpoint - please check the link below. Except from the link "To run a DB Instance under the BYOL model, you must have the appropriate Oracle Database license (with Software Update License & Support) for the DB Instance class and Oracle Database edition you wish to run. You must also follow Oracle's policies for licensing Oracle Database software in the cloud computing environment. DB Instances reside in the Amazon EC2 environment, and Oracle's licensing policy for Amazon EC2 is located https://www.oracle.com/us/corporate/pricing/cloud-licensing-070579.pdf"https://aws.amazon.com/rds/oracle/pricing/[] Oracle licensing options - Bring Your Own License (BYOL) - https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Oracle.Concepts.Licensing.html#Oracle.Concepts.Licensing.BYOLAgain, RDS is a hosting platform in this scenario not the license issuer. I sincerely hope I was able to shed some light on the matter for you from AWS standpoint. Have a great rest of the day!CommentShareEXPERTNIRUPAM_danswered a year agoEXPERTBrettski-AWSreviewed a year ago"


Question: CW Log Shipping to Self Hosted Elasticsearch on EKS

"Hi.We want to ship events matching an EventBridge rule in cloudwatch logs to our own self-hosted Elasticsearch. Using a Lambda to ship the logs would be a secondary option.Is there any native way to ship these events?Regards,SmrutiFollowComment"

Answer: "0EventBridge is used for events that indicate a change in your resources, for example - Describe*, Put*, Get* actions etc. And, for your use case 'Subscription filter' is an appropriate solution which is native to CloudWatch Logs. Using Subscription filter, which monitors for a particular pattern you mention - for any newly ingested events, you can set a destination (like a target in EventBridge) where these filtered out events are sent.Please keep in mind that these filters don't work retroactively, and are meant for only the log events ingested once after the filter is created.Read about subscription filters.CommentShareSUPPORT ENGINEERShreyas_Manswered 4 months ago"


Question: MSK : how to add a plugin to Kafka cluster?

I am creating an MSK cluster on AWS console. and I want to use the OPA plugin for Kafka.The OPA plugin is a ZIP file that I have to place in libs directory of the Kafka installation. But how can I upload this ZIP file on my MSK cluster? Is there maybe a way to connect to my brokers? Or should I add a property in a custom MSK configuration?Thanks for help 🙂FollowComment

Answer: 0Accepted AnswerAnswer : It is yet not possible to add OPA plugin to AWS MSK because it is not possible to access the file systems of the brokers (MSK is a managed service).More details --> https://repost.aws/questions/QUN9Nbz71ESdGOuZN9LLKfmA/msk-how-to-access-broker-file-systemCommentShareMaxanswered 2 months ago


Question: Hadoop across multiple regions

"I want to set up a hadoop cluster across multiple regions. However, as one may have already noticed, the instance can not bind to the elastic ip. As a result, the communications between the namenode in zone1 and the datanode in zone2 can not be initiated by start-dfs.sh, reporting a socket binding error.In my deployment, I set the "fs.defaultFS" in core-site.xml to "hdfs://ec2xxxx.amazonaws.com(public DNS):8020" and give access to all inbound/outbound traffics, but still fail to run the cluster. Could anyone please give me some advice? Thanks a lot!FollowComment"

Answer: "0Hi, Hadoop across multiple regions is NOT supported by AWS. In fact, AWS recommends all resources in the cluster should be in the same Availability Zone to optimize performance.Link: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-region.htmlAlso, here are some additional statements from Hortonworks and Cloudera on Hadoop cluster across multiple regions..Link: https://community.hortonworks.com/questions/224369/do-you-support-spanning-a-hadoop-cluster-over-mult.htmlHortonworks -While it is possible to span a cluster across multiple Availability Zones, we don’t generally recommend spanning availability zones for the following reasons:In AWS, there is a natural latency involved with data moving across multiple AZs which will lead to performance problems or other issues in the cluster. Specially as the cluster size and workload increases the performance issues are more pronounced.Double billing: As a natural part of cluster functioning, there will be data transfer. According to AWS FAQs - Each instance is charged for its data in and data out at corresponding Data Transfer rates. Therefore, if data is transferred between these two instances, it is charged at "Data Transfer Out from EC2 to Another AWS Region" for the first instance and at "Data Transfer In from Another AWS Region" for the second instanceLink: https://www.cloudera.com/documentation/other/reference-architecture/PDF/cloudera_ref_arch_aws.pdfCloudera EDH deployments are restricted to single regions. Single clusters spanning regions are not supported.Hope this helps!-randyCommentShareRandyTakeshitaanswered 4 years ago"


Question: Farm Remote Desktop Windows 2019 - Can not create user profile disk in fsx

"Hi, I've created a shared folder in fsx how repository for Virtual DiskWhen I tried to create the template VHD it show this  error message"Could not create the template VHD. Error Message: Unable to connect to WMI on server "dns name fsx", error The RPC server is unavailable. (Exception from HRESULT: 0x800706BA)From same server with command "net use " works fine.ThanksFollowComment"


Question: Can we alter/deny some of the ephemeral  ports used by Nat gateways (1024-65535 )?

"A customer is trying to develop an DDOS Resiliency solution. They are trying to access port 80 and 443 of a third-party component over internet. But the instance is in a private network, so they are using a NAT gateway in public subnet. It works fine when their is no deny rules in NACL of public subnet.But when they deny ports 1024-65535 in NACL, the instances looses internet access, they are not okay with keeping so many ports open to external world.They require only port 80 and 443 to be allowed in NACL where NAT gateway is located.  How can we achieve this? Is their any alternative approach to protect the subnet?FollowComment"

Answer: "0Accepted AnswerSo the problem is your customer is looking at NACL's and thinking they are traditional firewall rules and they are not.  NACL is a stateless firewall meaning that you have to define all the required ports both inbound and outbound.  Now the trouble with this is that most Protocols do not stick to a single Port number.  Take web traffic for example,  when you request a webpage your computer sends a request to web servers on port 80 or 443.  The webserver captures the request and then sends you a response that tells your computer what port it needs to use for this communication session.  The server does this because multiple people can't communicate on a single port so to handle more than one client it moves known traffic to the dynamic port ranges.Think of it like you walk into a DMV (or other government building that handles multiple functions) the first person you see asks you what you are here for.  After you respond they give you a ticket with a number on it.  That ticket tells you what window to go to in order to complete the task you are there for.  the service on port 80/443 is the first person who hands you a ticket and the windows is the higher level port used to completed the session.So that being said when using a stateless firewall, like the NCAL's, since the firewall doesn't track sessions you have to open the dynamic port range to allow for proper communication.  This lack of tracking and requirement to open so many ports when using NACL's is the reason we dont recommend using them for fine grain access control.  NACL's should be used for broad stroke control like allowing access to the IP addresses of your internal production network to the AWS prod but denying any access from the user or Dev IP space.  Not to mention the fact that NACL's only control traffic at a subnet level so traffic between instances inside the same subnet wont ever be evaluated by the NACL.The better option for control in almost all scenarios is to use security groups as your main control point as it is statefull and controls traffic at a the elastic networking interface.  Security groups are a deny all by default,  you have to define the ports that the service uses to initiate the session (80/443 in the above example) as well as where that traffic is from, for inbound rules, or where it is going, for outbound rules.  Being stateful, the security group is smart enough to understand the session so now when the server responds to the client telling him talk on a higher dynamic port the security group dynamically opens that port for communication between the client and server.  It than keeps tracking the session until either the client or server closes the session at witch time the security group no longer allows communication over that port.This is an oversimplification of an IP session and how the NACL's and Security groups work but hopefully it gives you enough information to take back to the customer and help them design a better architecture (limiting NACL usage).  Feel free to hit me up on chime if you need some additional support.CommentShareAWS-User-7786184answered 6 years ago"


Question: IoT QoS 1 Unacknowledged Publish Request Limit

AWS IoT Core Message Broker has a quota for maximum inbound unacknowledged QoS 1 publish requests: https://docs.aws.amazon.com/general/latest/gr/iot-core.html#message-broker-limitsWhat does this quota mean?Is it that AWS IoT Core can only have 100 messages waiting to send a PUBACK. Does this quota mean the client is limited on how many QoS 1 messages it can publish?FollowComment

Answer: "0Accepted AnswerAWS IoT Core will not wait to send a PUBACK, however there may be reasons for reaching that quota. As an example: In a situation where the downlink (i.e. Server -> Client) connectivity is slower then uplink (Client -> Server) connectivity it can cause a situation where this quota could be overrun. So yes, client is limited on how many "unacknowledged" QoS1 messages it can publish.This should also be seen in conjunction with "Outbound publish requests per second per account". A broker sends the message to all subscribing clients and then replies with a PUBACK packet. If because of downlink connectivity or for some other reason, outbound queue is full, that will build a backlog of unacknowledged QoS1 messages.CommentShareAndrei Sanswered 2 years ago"


Question: Support for .baby TLD

"We would like to transfer our domain over to Route 53 but .baby is not on Generic TLD support list. Is it possible to get this TLD added.Also, is it possible to transfer the domain (from GoDaddy) without the TLD being added to the list?FollowComment"

Answer: "1According to the documentation,If a TLD is not on the list, you can't currently transfer the domain registration to Route 53. That said, is there any reason you want to transfer the domain?One way to use R53 (for better integration with AWS services, for example) without actually transfer the domain, is to update the name servers in GoDaddy with R53 name servers. You can refer to the process here.Also if you have a lot of domains, to make the process easier you can create a reusable delegation set.CommentShareJason_Sanswered a year agoEXPERTToni_Sreviewed a year ago"


Question: EC2 instance "terminating" instead of "stopping"

"I went to my EC2 instances (I had two) and I selected one of them and clicked on the "instance state" that was running and changed it to "stop" in hopes to restart or refresh as it was not responsive. Instead, BOTH instances got "terminated" instead of stopping and I can't start the instance again. PLEASE HELP! how can I start the instances again?? Thanks!FollowComment"

Answer: "1Hi,unfortunately is not possible to restart a "terminated" instance and all the volume that have been deleted as part of the termination process as described on this article: https://repost.aws/knowledge-center/recovery-terminated-instanceDid your instance were part of an autoscaling group? in this case the instance could have been terminated because as stopped was failed the health check from Ec2 and/or from the ELB. https://repost.aws/knowledge-center/auto-scaling-instance-how-terminatedBut if this is the case you should be able to recover your instance from the instance template of the autoscaling group. Otherwise to recover your instance you could use a snapshot if available.CommentShareSimone Tallevianswered 25 days ago0Thank you so much for your quick response!My instances were not part of auto scaling groups. They both disappeared now from the launch view and when I navigate to the auto scaling groups there isn't activity history to view just "create auto scaling groups".I did check cloud trail > event history  and found that despite I only selected to stop one of the instances , "CCSSession" as a user terminated both instances  instead of stopping 3 seconds later. I can't tell why the stopping action turned into termination if you can educate me on that for future reference that would be great too.It seems like the only option I have now is to launch a new instance using Amazon Machine Images (AMI) of the old ones. I don't know the impact of that, will I need to recreate the entire set up again for e.g. required for OS reporting etc?? or will it be an exact copy with regards to installation and set up?I also need to protect the new launched instance from EC2 accidental termination. Following the guidance provided here: https://repost.aws/knowledge-center/recovery-terminated-instance.Is that correct? I greatly appreciate your help!CommentSharerePost-User-1248801answered 25 days ago"


Question: Redirection from non-www to www on ALB

"I'm trying to add redirection from non-www to www for current domain on Route 53 that is mapped to ALB as belowhttp://somedomain.sg -> https://www.somedomain.sgI have added rule on http 80 listener to check if host header is somedomain.sg, redirect to HTTPS://www.#{host}:443/#{path}?#{query}, else if not matched, redirect to HTTPS://#{host}:443/#{path}?#{query}.I have another 443 listener on ALB which is also currently forwarding to target group of attached instances.I'm unable to get the redirection on broswer, even though both non-www and www domains on Route 53 are mapped to same ALB and ACM certificate on ALB supports both www and non-www domains. Testing with curl on domain somedomain.sg also shows 301 redirect to www.somedomain.sgAm I missing out on something that is affecting the redirect?FollowComment"

Answer: 0Accepted AnswerThe rule for no match is "HTTPS://#{host}:443/#{path}? #{query}" instead of "HTTPS://www.#{host}:443/#{path}? #{query}" instead of "HTTPS://www.#{host}:443/#{path}?I also think it is enough to create a CNAME record in Route 53 as follows.record-name: somedomain.sgtype: cnamevalue: www.somedomain.sgCommentShareEXPERTRiku_Kobayashianswered 2 months ago


Question: Static website using s3 buckets and cloudfront

"I have been trying to create a secure website with a domain name registered in route 53. I Requested a public certificate so that Amazon CloudFront distributions require HTTPS. I created 2 buckets in s3 and selected on Block all public access. I followed the instructions to create a cloudfront distribution in "Configuring Amazon Route 53 to route traffic to a CloudFront distribution". I created OAC and copied the policy to the bucket policy. I created an alias record that points to my CloudFront distribution.Can't access the website.If the Block all public access is set to on for a bucket used for a static website, can the website be accessed by  routing traffic to a CloudFront distribution.FollowComment"

Answer: "1Accepted AnswerHi User,You should be able to use CloudFront to serve a website hosted on an S3 bucket with Block Public Access settings enabled. You might want to refer to this link for more details on how you can configure it.Hope this helps!CommentShareturtleanswered 3 months agorePost-User-9152533 3 months agoThank you! I will check the link out.Share1Public Access to your bucket must be off, otherwise this will not work. If you read the link that @turtle provided it says:Add a bucket policy that allows public read access to the bucket that you created.Note: For this configuration, the S3 bucket's block public access settings must be turned off. If your use case requires the block public access settings to be turned on, use the REST API endpoint as the origin. Then, restrict access by an origin access control (OAC) or origin access identity (OAI).CommentShareNikoanswered 3 months agoNiko 3 months ago@rePost-User-9152533 - if you think my answer is to your satisfaction, can you please accept it  ? :) if not, happy to assist you more.SharerePost-User-9152533 3 months agoThank you! I will have to read up on the REST API.Share0When I go to certificate manager (certificate is issued) and click “create records in route 53” and I clear the filters, “Validation status: Pending validation”, “Validation status: Failed”, my domains appear with “validation status = success”, “Is domain in Route 53? = yes”. The create record button is not available to be clicked to create the CNAME TYPE records in route 53. The DNS records are validated, and the  domain is in Route 53.Why can’t I “create records in route 53?CommentSharerePost-User-9152533answered 3 months agoturtle 3 months agoFor you to be able to have an active "Create records in Route 53" button, you would have to satisfy these 3 requirements as per this link:You are using Route53 as your DNS providerYou have permission to write to the zone hosted by Route 53Your fully qualified domain name (FQDN) has not already been validatedIn this case, it seems like your domain name has already been validated and hence the button is  not available.Share0I used this link above to set up my s3 bucket to be accessed as a static website. I have used the REST API endpoint as the origin. I restricted access with an origin access control (OAC) I used an incognito window to access the website and it still doesn't find it.No  mention of route 53. Does it need a CNAME type record?CommentSharerePost-User-9152533answered 3 months ago"


Question: DirectoryServicePortTest can't verify forest functional level

"Hi,I just deployed an AD connector in AWS and it connects to my on-prem domain controllers. As part of verifying connectivity per AWS doc (https://docs.aws.amazon.com/directoryservice/latest/admin-guide/prereq_connector.html#connect_verification), I remote into a VM on the subnet where the AD connector has ENI in and test with DirectoryServicePortTest.exe. The ports are open fine but it can't query the forest functional level. I am sure the DC/DNS I use to test is good and SRV records are there. [my-domain] is the fully qualified domain name and forest functional level is 2012R2 which meets the requirement.C:\>DirectoryServicePortTest.exe -d [my-domain] -ip [my-dns] -tcp "53,88,389" -dup "53,88,389"Testing forest functional level.The domain [my-domain] could not be found.Testing TCP ports to [my-dns]:Checking TCP port 53: PASSEDChecking TCP port 88: PASSEDChecking TCP port 389: PASSEDAny suggestions on what might be the issue. Thanks.FollowComment"

Answer: "0Hello,Thank you so much for your rePost question, my name is RJ an engineer that will be assisting with your inquiry.In order for the directory services port test (DSPT) utility to validate the forest and domain functional levels, the tool must be used with an authenticated domain account. At this time, the DSPT utility does not accept credentials as parameters, and instead will use the security context of the current user.That being said, ADConnector supports forest and domain functional levels at 2003+ or higher.CommentShareSUPPORT ENGINEERRJ-Danswered a year ago"


Question: AWS STS Temporary Credentials S3 Access Denied PutObject

"I am following  https://www.2ndwatch.com/blog/use-aws-iam-sts-access-aws-resources/  blog posting and my understanding is the S3 Bucket Policy Principal requesting the temporary credentials, one approach would be to hard code the Id of this User but the post attempts a more elegant approach of evaluating the STS delegated user (when it works).arn:aws:iam::409812999999999999:policy/fts-assume-roleIAM user policy{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "sts:AssumeRole",            "Resource": "*"        }    ]}arn:aws:s3:::finding-taylor-swifts3 bucket policy{    "Version": "2012-10-17",    "Id": "Policy1581282599999999999",    "Statement": [        {            "Sid": "Stmt158128999999999999",            "Effect": "Allow",            "Principal": {                "Service": "sts.amazonaws.com"            },            "Action": "s3:PutObject",            "Resource": "arn:aws:s3:::finding-taylor-swift/*"        }    ]}conor@xyz:~$ aws configure --profile finding-taylor-swiftAWS Access Key ID [****************6QNY]: AWS Secret Access Key [****************+8kF]: Default region name [eu-west-2]: Default output format [text]: jsonconor@xyz:~$ aws sts get-session-token --profile finding-taylor-swift{    "Credentials": {        "SecretAccessKey": "<some text>",         "SessionToken": "<some text>",         "Expiration": "2020-02-11T03:31:50Z",         "AccessKeyId": "<some text>"    }}conor@xyz:~$ export AWS_SECRET_ACCESS_KEY=<some text>conor@xyz:~$ export AWS_SESSION_TOKEN=<some text>conor@xyz:~$ export AWS_ACCESS_KEY_ID=<some text>conor@xyz:~$ aws s3 cp dreamstime_xxl_concert_profile_w500_q8.jpg s3://finding-taylor-swiftupload failed: ./dreamstime_xxl_concert_profile_w500_q8.jpg to s3://finding-taylor-swift/dreamstime_xxl_concert_profile_w500_q8.jpg An error occurred (AccessDenied) when calling the PutObject operation: Access Deniedconor@xyz:~$AWS CLI has been setup as described  https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html#using-temp-creds-sdk-cli"When you run AWS CLI commands, the AWS CLI looks for credentials in a specific order—first in environment variables and then in the configuration file. Therefore, after you've put the temporary credentials into environment variables, the AWS CLI uses those credentials by default. (If you specify a profile parameter in the command, the AWS CLI skips the environment variables. Instead, the AWS CLI looks in the configuration file, which lets you override the credentials in the environment variables if you need to.)The following example shows how you might set the environment variables for temporary security credentials and then call an AWS CLI command. Because no profile parameter is included in the AWS CLI command, the AWS CLI looks for credentials first in environment variables and therefore uses the temporary credentials."So far SO has only suggested using assume-rolehttps://stackoverflow.com/questions/60153869/aws-sts-temporary-credentials-s3-access-denied-putobjectFollowComment"

Answer: "0kindly answered here https://stackoverflow.com/questions/60153869/aws-sts-temporary-credentials-s3-access-denied-putobject?noredirect=1#comment106405650_60153869There is no need to use a Bucket Policy for your scenario. A bucket policy is applied to an Amazon S3 bucket and is typically used to grant access that is specific to the bucket (eg public access).Using an IAM RoleIf you wish to provide bucket access to a specific IAM User, IAM Group or IAM Role, then the permissions should be attached to the IAM entity rather than the bucket.(For get-session-token, see the end of my answer.)SetupLet's start by creating an IAM Role similar to what you had. I choose Create role, then for trusted entity I select Another AWS account (since it will be assumed by an IAM User rather than service).I then create an Inline policy on the IAM Role to permit access to the bucket:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": "s3:*",            "Resource": "arn:aws:s3:::my-bucket"        }    ]}(It's normally not a good idea to assign s3:* permissions, since this lets the user delete content and even delete the bucket. Try to restrict it to the minimum permissions that are actually required.)The Trust Relationship on the IAM Role determines who is allowed to assume the role. It could be one person, or anyone in the account (as long as they have been granted permission to call AssumeRole). In my case, I'll assign it to the whole account:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::MY-ACCOUNT-ID:root"      },      "Action": "sts:AssumeRole"    }  ]}Now there are a few different ways to assume the role...Simple method: IAM Role in credentials fileThe AWS CLI has the ability to specify an IAM Role in the credentials file, and it will automatically assume the role for you.See: Using an IAM Role in the AWS CLI https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.htmlTo use this, I add a section to my .aws/config file:[profile foo]role_arn = arn:aws:iam::MY-ACCOUNT-ID:role/MY-ROLE-NAMEsource_profile = defaultI could then simply use it with:aws s3 ls s3://my-bucket --profile fooThis successfully lets me access that specific bucket.Complex method: Assume the role myselfRather than letting the AWS CLI do all the work, I can also assume the role myself:aws sts assume-role --role-arn arn:aws:iam::MY-ACCOUNT-ID:role/MY-ROLE-NAME --role-session-name foo{    "Credentials": {        "AccessKeyId": "ASIA...",        "SecretAccessKey": "...",        "SessionToken": "...",        "Expiration": "2020-02-11T00:43:30+00:00"    },    "AssumedRoleUser": {        "AssumedRoleId": "AROA...:foo",        "Arn": "arn:aws:sts::MY-ACCOUNT-ID:assumed-role/MY-ROLE-NAME/foo"    }}I then appended this information to the .aws/credentials file:[foo2]aws_access_key_id = ASIA...aws_secret_access_key = ...aws_security_token= ...Yes, you could add this to the credentials file by using aws configure --foo2, but it does not prompt for the Security Token. Therefore, you need to edit the credentials file to add that information anyway.I then used the profile:aws s3 ls s3://my-bucket --profile foo2It allowed me to successfully access and use the bucket.Using GetSessionTokenThe above examples use an IAM Role. This is typically used to grant cross-account access or to temporarily assume more-powerful credentials (eg an Admin performing sensitive operations).Your Question references get-session-token. This provides temporary credentials based on a user's existing credentials and permissions. Thus, they cannot gain additional permissions as part of this API call.This call is typically used either to supply an MFA token or to provide time-limited credentials for testing purposes. For example, I could give you credentials that effectively let you use my IAM User, but only for a limited time.CommentShareC9n7ranswered 3 years ago"


Question: Do i need to re associate if the file has updated for Analyzers in Opensearch

"I'm using elasticsearch 7.7.I have stopwords which is in s3 to remove while i am searching.I have created analyzer for thatsetting is below{  "settings": {    "index": {      "analysis": {        "analyzer": {          "my_stop_analyzer5": {            "type": "custom",            "tokenizer": "standard",            "filter": "my_filter5"          }        },        "filter": {          "my_filter5": {            "type": "stop",            "stopwords_path": "analyzers/<your analyzer ID>",            "updateable": true          }        }      }    }  },  "mappings": {    "properties": {      "description": {        "type": "text",        "analyzer": "standard",        "search_analyzer": "my_stop_analyzer5"      }    }  }}I am using python api to connect Cluster and update the settings. python code is belowes.indices.close("indexname")es.indices.put_settings(index="indexname", body=settings, id=1234) #id is some id required for below version 7.8 es.indices.open("indexname")I have updated the s3 file of stopwordsDo i need to do dissociate and associate again for this or any extra steps should i do if only i have updated the stopword file in s3?https://docs.aws.amazon.com/opensearch-service/latest/developerguide/custom-packages.htmlFollowComment"


Question: Reading Aurora Postgress Table with Spark SQL on EMR

"Hi there,I'm trying to read an Aurora Postgres table with Spark on EMR. The Aurora Postgres table has been successfully crawled and the respective table in the Glue Data Catalog has been created. The EMR cluster has been configured with Glue Data Catalog for Spark and the configurations mentioned in our documentation.https://docs.aws.amazon.com/emr/latest/ReleaseGuide/emr-spark-glue.htmlHowever, when I'm running queries against the table in Spark, I'm getting the following error.scala> spark.sql("SELECT * FROM `aurora-glue`.`glue_public_distributors`")18/09/11 14:17:40 WARN CredentialsLegacyConfigLocationProvider: Found the legacy config profiles file at [/home/hadoop/.aws/config]. Please move it to the latest default location [~/.aws/credentials].org.apache.spark.sql.AnalysisException: org.apache.hadoop.hive.ql.metadata.HiveException: Unable to fetch table glue_public_distributors. StorageDescriptor#InputFormat cannot be null for table: glue_public_distributors (Service: null; Status Code: 0; Error Code: null; Request ID: null);  at org.apache.spark.sql.hive.HiveExternalCatalog.withClient(HiveExternalCatalog.scala:106)  at org.apache.spark.sql.hive.HiveExternalCatalog.tableExists(HiveExternalCatalog.scala:808)  at org.apache.spark.sql.catalyst.catalog.SessionCatalog.tableExists(SessionCatalog.scala:385)  at org.apache.spark.sql.catalyst.analysis.Analyzer$ResolveRelations$.isRunningDirectlyOnFiles(Analyzer.scala:682)...Any ideas what I am doing wrong here?FollowComment"

Answer: "0Accepted AnswerYou cannot run Spark SQL on Aurora Postgres using the Glue Catalog as a metadata store. Just like Athena, Spark SQL can only use the Glue Catalog for tables in S3. To run Spark SQL on Aurora Postgres you would need to use Spark JDBC packages to directly query the database.properties = {    ...    "driver": "org.postgresql.Driver"}jdbc_url='<jdbc-url>'df=spark.read.jdbc(url=jdbc_url, table='<tablename>', properties=properties)CommentShareAWS-User-4669487answered 5 years ago"


Question: SES config set with custom domain getting http error 400

"I am configuring a custom domain to handle open and click tracking, I follow the documentation and everything seems correct, but I am getting http 400 error when redirect to the awstrack.com url.Documentation:https://docs.aws.amazon.com/ses/latest/dg/configure-custom-open-click-domains.html1 - Custom sub domain link.domain.com redirection to r.sa-east-1.awstrack.me2 - Using route 53, with A alias to cloudfront, cloudfront with https and custom domain link.domain.com, cloudfront connected to a s3 using website to redirect to r.sa-east-1.awstrack.me.3 - SES config set changed to use the domain link.domain.com4 - Sending emails using the SES (sa-east-1 region), with config set, it is generating open/click events with the custom domain link.domain.comHere and example of link generated in one of the emails sent (where it looks ok):https://link.domain.com/CL0/https:%2F%2Fgoo.gl%2Fmaps/1/01030181e3dbf7cb-7eb95765-70b3-40bf-aad2-79b4667907e3-000000/l5QlO8RLGNlcYSV4os5PuGMo4lQbY6Ne1CCNhdoOk3w=62Then I think it "correctly" redirects to r.sa-east-1.awstrack.me:https://r.sa-east-1.awstrack.me/CL0/https:%2F%2Fgoo.gl%2Fmaps/1/01030181e3dbf7cb-7eb95765-70b3-40bf-aad2-79b4667907e3-000000/l5QlO8RLGNlcYSV4os5PuGMo4lQbY6Ne1CCNhdoOk3w=62But the awstrack.me link above doesn't work, it returns theThis page isn’t working: HTTP ERROR 400Anyone has experience with custom domain in config sets for open/click events?FollowComment"


Question: "When I used host CPP and AFI, I reported an error while executing host cpp."

"I’m using AMI/1.8.1. And I use vu9p and vitis to generate the xclbin file.When I used host CPP and AFI, I reported an error while executing host cpp.It prompt：“[XRT] ERROR: No devices found. Error: Failed to find an OpenCL platform! Test failed”. But I have source /opt/xilinx/xrt/setup.sh before executing host cp.Then , When I use “xbutil dmatest” according ug1393, it prompt: ”INFO: Found total 1 cards, 0 are usable” “ERROR: Card index 0 is out of range. ”So the device or driver have error? I need to terminate the instance, then reinstall the AMI?FollowComment"

Answer: "0Hi zqsteve,XRT requires that the mpd service is started on the instance. mpd is not started by default on F1.We include a script on our repository called: vitis_runtime_setup.sh that sets up mpd for first time use. We have documented it here: https://github.com/aws/aws-fpga/blob/master/Vitis/docs/XRT_installation_instructions.md#mpdWould you be able to retry by following the runtime setup steps listed here?: https://github.com/aws/aws-fpga/blob/master/Vitis/README.md#runonf1Thanks,DeepCommentShareDeep_Panswered 3 years ago"


Question: EFS Deletion protection

"Hello,EC2 and ALB for example have an attribute to prevent deletion. Is  this available for EFS ?ThanksFollowComment"

Answer: "0Accepted AnswerHi, @MaanEFS does not have delete protection.You can protect it with built-in replication or AWS Backup instead.CommentShareEXPERTiwasaanswered a year ago"


Question: Services That Require Unique Names

Is there a list of AWS services that use a global namespace like S3 - i.e. require unique bucket names?FollowComment

Answer: "2Hi,I understand you would like to know the AWS services that require unique names convention like S3.No, but I would say it depends. Just like S3 have globally bucket unique bucket names, cognito user pool domains are unique within a region. S3 designed in such a manner because it is widely used for hosting public websites just like domain names, some other AWS services are associated with the region only i.e. within a region you can't have resources with the same name.If any, the AWS documentation will also detail any naming rules and convention for services that are globally unique or region based.I hope this helps. Let me know if I answered your question by up voting my response as accepted or if you have any follow-up.Kind regards,AhmedReference:[1] https://docs.aws.amazon.com/index.html[2] https://docs.aws.amazon.com/AmazonS3/latest/userguide/BucketRestrictions.html[3] https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.htmlCommentSharerePost-User-5076019answered a month ago"


Question: How to set Apache-accessible SELinux policy for EFS mounted user directories?

"When I mount my EFS to a user directory, the directory policy becomes system_u:object_r:nfs_t:s0, which is too restrictive - I need it to behave more like a typical user directory, which is unconfined_u:object_r:user_home_dir_t:s0. How do I change this?FollowComment"

Answer: "0Accepted AnswerI was able to fix this by defining the context while mounting the directories. I also had to define it in my fstab configuration to ensure the definition persisted after reboot. Additionally, I needed to set domain policy to httpd_sys_content_t, which allowed apache to access the content.CommentShareamazon-linux-2022answered 6 months ago"


Question: Enable Lambda trigger

Hi!I am following this blog post about connecting Google Analytics data to S3 through appflow:I can add a trigger to the lambda function but I can't enable it and I can't figure out why. I can see the enable and disable but they are not clickable.FollowComment

Answer: 1Accepted AnswerThe article refers to an earlier version of lambda.CommentShareAWS-learneranswered a year ago


Question: How to install SageMath and LinBox C++ library on Amazon EC2 server

"I would like to install SageMath on my AWS EC2 server, however when I type sudo yum install sagemath, I get the error that sagemath is not available, which was to be expected. How can I get around this?Sage: http://www.sagemath.org/index.htmlAlso I'd like to install the C++ library called LinBox, which has dependencies on other C++ libraries: Givaro, FFLAS-FFPACK, and BLAS. So how would I install these?LinBox: https://linalg.org/P.S. I am quite new to cloud computing so please try to be as explicit as possible so that I may understand! Thank you!FollowComment"

Answer: "0Not resolved*CommentShareKBarianswered 4 years ago0I am using Ubuntu server, so the commands will be sudo apt-get instead of yumEdited by: KBari on Sep 4, 2019 10:22 PMCommentShareKBarianswered 4 years ago0These instructions are for EC2 running Ubuntu 18.04 with 20 GB EBS storageHow to install sage:sudo suapt install pythoncd /optwget http://mirrors.mit.edu/sage/linux/64bit/sage-8.8-Ubuntu_18.04-x86_64.tar.bz2tar -xjf *.tar.bz2ln -s /opt/SageMath/sage /usr/local/bin/sagesageHow to install LinBox C++sudo apt-get updatesudo apt-get install liblinboxsage-devHope this helps!-randyCommentShareRandyTakeshitaanswered 4 years ago0Thanks!!CommentShareKBarianswered 4 years ago"


Question: AWS Rekognition Custom Label MLOps

"Hello,I have trained the custom model using AWS Rekognition Custom label. Now I want to create MLops pipeline in that. I have looked into several blogs but I am not able to find a proper work flow to set MLOps pipeline in AWS Rekognition.So can you help me with this.Regards,Viraj HapaliyaFollowComment"

Answer: "0Hello,Here is a great blog post how to do that:Part 1 https://aws.amazon.com/blogs/machine-learning/part1-automate-continuous-model-improvement-with-amazon-rekognition-custom-labels-and-amazon-a2i/Part 2 https://aws.amazon.com/blogs/machine-learning/part2-automate-continuous-model-improvement-with-amazon-rekognition-custom-labels-and-amazon-a2i/CommentShareAleksandr_Panswered 10 months ago"


Question: Sagemaker Feature Store Spark connector is duplicating data

"Hi!I'm using the Feature Store Spark connector to ingest data into the Sagemaker Feature Store and when we try to ingest data to a Feature Group with the online store enabled, the data is duplicated.In the image bellow, "customer_id" is the ID feature, "date_ref" the event column. All the features are equal for the same ID and EventTime column, except the "api_invocation_time".If the feature group doesn't have the online store enabled, we ingest the data directly to the offline store without issues. But when we use the "Ingest by default" option in the connector (not specifying the "target_stores" in the connector, uses the PutRecord API), the data ingested is duplicated:params = {    "input_data_frame":dataframe,    "feature_group_arn": feature_group_arn            }if not online_store_enabled:    params["target_stores"] = ["OfflineStore"]    logger.info(f"Ingesting data to the offline store")pyspark_connector.ingest_data(**params)logger.info("Finished the ingestion!")failed_records = pyspark_connector.get_failed_stream_ingestion_data_frame()How can I solve this issue using the connector?EDIT:Apparently, the problem is in the "get_failed_stream ingestion data frame" method. This method, instead of just returning a dataframe, ingests the data again before returning the failed records. Removing the method from the ingestion pipeline resolves the issue, although we lose a form of validation.FollowComment"

Answer: "1Accepted AnswerThis issue should be patched in 1.1.1. If you upgrade from 1.1.0, get_failed_stream_ingestion_data_frame should no longer trigger any re-computation now.CommentShareCan Sunanswered 3 months ago"


Question: AWS Cloudshell Termination

We received an email about the termination of the AWS CloudShell but we only sure the simple storage S3.  Does the AWS CloudShell affects us in any way.  All the information I find is very confusing and I have been unable to find a phone number to call customer service.  Just need to know if I need to worry about the AWS CloudShell being deleted since we only use the S3 simple storage service.  Thank you.FollowComment

Answer: 0AWS CloudShell persistent storage is deleted 120 days after the last session.https://docs.aws.amazon.com/cloudshell/latest/userguide/limits.htmlThis does not affect user S3 resources in any way.CommentSharehayao-kanswered 10 months agoEXPERTkentradreviewed 10 months ago


Question: AWS cloud watch event pattern to detect S3 buckets creation/modification with public access

"I am trying to create an AWS Cloud watch event which will trigger an email whenever a S3 bucket is created or modified to allow public access.I have created the cloud trail, log stream and am tracking all the S3 events logs. When i am trying to create a custom event by giving the pattern to detect S3 buckets with public access i am not able to fetch any response or the event doesn't get triggered even if i create bucket with public access. Can you help me out with the custom pattern for the same ?I have tried giving GetPublicAccessBlock, PutPublicAccessBlock etc., in event type but no luck. Please suggest accordingly.FollowComment"

Answer: 0You can use IAM access analyzer to detect a S3 bucket that allow public access.https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.htmlYou can send email for the detection results with Amazon EventBridge and Amazon SNS.https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-eventbridge.htmlCommentShareimikyanswered 4 months ago


Question: apigatewayv2 websocket- put authorizer context variable in $connect route when using IAM authorizer

"Hello, I'm trying to use apigatewayv2 websocket.Is there a way to save context variables at route:$connect when using Iam authorizer?My purpose is verify context variables in $connect route and continue using these variables in any other routes.(To restrict important variables like  identityId...)I know I could do this when using lambda authorizer, with lambda output {context: <any>}.But when I'm trying to use Iam authorizer, I could not find how to do it.FollowComment"


Question: Evaluating Timestream DB for multi-tenant SaaS application - Per database encryption quota limit

"We are evaluating Timestream DB for handling metrics for our SaaS application that we are developing on AWS. In order to maintain data isolation we are looking at encrypting each customer's data separately. For Timestream this appears to mean we need a separate database for each customer as the encryption is done at a database level.In short, this means we are limited to 500 databases per account (current quota limit) and therefore 500 customers if we stick to a single AWS account. I've checked Service Quota console and it appears none of these limits can be increased.Do you have a recommended pattern for overcoming this limitation or a different approach?Thanks,FollowComment"

Answer: "0If you are looking for a siloed tenancy at the database scope, you can explore adopting multiple AWS accounts to overcome the account level limit of 500 databases.If you can isolate your tenants at the table scope by limiting queries for users to their specific tables, then you have can go upto 50K tables.  Here is an IAM policy that shows how you can limit users by table.CommentShareAWS-User-6438840answered a year ago"


Question: Querying an index with Android Amplify GraphQL

"I'm trying to perform a GraphQL query against an index using Amplify and the Android SDK.I have a query that works when tested via the AppSync dashboard. It returns the one record I can see in DynamoDB that it should match against.  membersEmailByInviteCode is an index defined in the Schema.query get {   membersEmailByInviteCode(email: "test@example.com" inviteCode: { eq: "CustomCode"} ) {     items {     id    }   }  }When I enable CloudWatch Logs and run the query from within the code I can see the following being sent, but I get an empty object back, which I'm guessing means that it hasn't been able to find anything.query get($email: String!, $code: String!) { membersEmailByInviteCode(email: $email inviteCode: { eq: $code} ) { items { id } } }, Operation: null, Variables: {    "email": "test@example.com",    "code": "CustomCode"}Operation is null, where it is get if I run the query via the console. I can't see a way of settings this.The Android side of things look like this   private fun getEmailCodeRequest(email: String, code: String): GraphQLRequest<ClubMember> {        val document = (                "query get(\$email: String!, \$code: String!) { "                  + "membersEmailByInviteCode(email: \$email inviteCode: { eq: \$code} ) { "                    + "items { "                      + "id "                    + "} "                  + "} "                + "}")        return SimpleGraphQLRequest(            document,            mapOf("email" to email, "code" to code),            ClubMember::class.java,            GsonVariablesSerializer())    }andAmplify.API.query(getEmailCodeRequest(email.text.toString(), code.text.toString()),I have been able to create a record using GraphQL, and I'm using auth and Rest API, so my app is working OK with the Android SDK. It just I can't get this to work.Anyone got any ideas?ThanksFollowComment"

Answer: "0I thought I might get a Model object populated with just the id, but what I am getting is just a JSON string back. I needed to process the JSON to get the id from it.CommentShareMPHaskinsanswered 8 months ago"


Question: Live streaming cost down

"I want to create live stream service using AWS, and I refer to this. But cost of network output is too high. I want to know how to saving cost. Any good idea?FollowComment"

Answer: "2Hi,If you don't need any advanced features like catch-up, timeshift, repackaging, live to VOD or DRM, you can simply use the foundational live streaming solution on AWS, that uses S3 instead of AWS Elemental MediaPackage : https://docs.aws.amazon.com/solutions/latest/live-streaming-on-aws-with-amazon-s3/architecture-overview.htmlYou can also reduce the number of outputs you have and/or reduce the bitrate on some (or all) of those outputs to reduce costs.ThanksCommentSharePedro_Fanswered 2 months ago0There are three main patterns for live-streaming video on AWS:Live Streaming on AWS [1]Live Streaming on AWS with Amazon S3 [2]Amazon Interactive Video Service (IVS) [3]As noted by Pedro, the specific features you would like to offer in your service will drive you towards on solution or another.As a general statement, the largest cost factor in live-streaming is video viewership (network output).As a managed service, IVS video output pricing is very straightforward based on the video quality (SD, HD, Full HD) as follows:SD = $0.0375 per viewer * hourHD = $0.0750 per viewer * hourFull HD = $0.1500 per viewer * hourCost example 2 for both of the other live streaming solutions make the same general assumptions and come out with a slightly higher rate: $0.153149 per viewer * hour.As a general statement, if you want to stream Full HD (eg 1080p), it will cost right around $0.150 - $0.153 per viewer * hour (network output costs) regardless of solution.To reduce overall costs, you must reduce the bitrate your viewers see, ideally without impacting the user experience. This is where the two Livestreaming solutions can help reduce your costs, by using Adaptive Bitrate (ABR) [4] and Quality-defined Variable Bitrate [5].Both of these solutions utilize ABR and the full Live Streaming solution also uses QVBR during the MediaPackage stage, effectively reducing the average bitrate your viewers will see without impacting the quality of their experience.This is why the cost estimate for both solutions indicates:The examples provided are likely higher than the actual costs of running this solution. The intent was to provide a guide to the pricing that is easily understood. Where assumptions were needed, we used factors that were straightforward to calculate and also likely be more expensive than the actual cost.This is expanded upon later in cost example 2:QVBR and variable video complexity can result in an output bandwidth that is 10-50% lower than the price estimate providedIn short, livestreaming network output costs are primarily driven by viewer bitrate. The solution examples provide the max network costs for the scenario; using the solutions as directed will likely result in much lower network output costs, with the exact impact dependent on the types of devices your viewers use and the quality of their internet connection.https://docs.aws.amazon.com/solutions/latest/live-streaming-on-aws/architecture-overview.htmlhttps://docs.aws.amazon.com/solutions/latest/live-streaming-on-aws-with-amazon-s3/welcome.htmlhttps://aws.amazon.com/ivs/https://docs.aws.amazon.com/mediaconvert/latest/ug/auto-abr.htmlhttps://docs.aws.amazon.com/mediaconvert/latest/ug/cbr-vbr-qvbr.htmlCommentShareMichael_Ranswered 2 months ago"


Question: Code-Deploy Versions on us-Govcloud-west

"I was wondering...The Code deploy versions for GovcloudWest1 are a bit behind us-east-1, is there a time table to know when there will be updates released?us-east-1: version 1.4.0gov-us-west-1: version 1.3.1 (borderline depreciated)Thanks.FollowComment"


Question: Minimal DynamoDB Permissions for EMR EMRFS Consistent View

"Hey folks, does anyone know what a minimal IAM policy statement would be for granting Amazon DynamoDB access to Amazon EMR Cluster members for the purposes of EMRFS Consistent view?AmazonElasticMapReduceforEC2Role grants dynamodb:* on * resources, which is pretty broad.The ideal answer would have both the limited set of actions required, and a narrower resource spec.Thanks!FollowComment"

Answer: "0Accepted AnswerYou can try the following template. EmrFSMetadata is default name for the DDB table, but this can be overridden if a different name is preferred and use the policy accordingly.  But you can take a look S3 Optimizer. There is no need for a Dynamo DB table with S3 Optimizer and if the output is in Parquet.    {        "Version": "2012-10-17",        "Statement": [            {                "Sid": "VisualEditor0",                "Effect": "Allow",                "Action": [                    "dynamodb:BatchGetItem",                    "dynamodb:BatchWriteItem",                    "dynamodb:UpdateTimeToLive",                    "dynamodb:ConditionCheckItem",                    "dynamodb:PutItem",                    "dynamodb:DeleteItem",                    "dynamodb:Scan",                    "dynamodb:ListTagsOfResource",                    "dynamodb:Query",                    "dynamodb:UpdateItem",                    "dynamodb:DescribeTimeToLive",                    "dynamodb:CreateTable",                    "dynamodb:DescribeTable",                    "dynamodb:GetItem",                    "dynamodb:UpdateTable",                    "dynamodb:DescribeTableReplicaAutoScaling"                ],                "Resource": "arn:aws:dynamodb:us-east-1:AccountID:table/EmrFSMetadata"            }        ]    }CommentShareVivek_Sanswered 3 years ago"


Question: AmazonS3.AmazonS3Exception: AuthMethodNotRecognized

"I am developing a web API in .NET6.I have this problem, "AmazonS3.AmazonS3Exception: AuthMethodNotRecognized", when I try to use a method of the IAmazonS3 interface (ex. ListBucketAsync, CreateBucketAsync etc.).How can I fix it?I use the AWSSDK.S3 3.7.8.26  in my project.Thanks in advanceFollowCommentDmitry Balabanov a year agoPlease provide a snippet of you code demonstrating how you create an instance of the S3 client object. Also, please elaborate in which environment you call the API (from a Lambda function? from a container? from your local machine?) How do you provide credentials to the API calls?ShareAWS-User-ADP-1863324 a year agoHi Dimitry ,i'm using AWSSDK.S3 "Version =" 3.7.8.26" and I would like to communicate with an external storage to amazon (S3 compatible)public AppConfiguration(){_awsAccessKey = appSetting["AwsAccessKey"];_awsSecretAccessKey = appSetting["AwsSecretAccessKey"];_restEndPoint = appSetting["RestEndPoint"];_as3Config = new AmazonS3Config{ServiceURL = _restEndPoint};_basicAwsCredentials = new BasicAWSCredentials(_awsAccessKey, _awsSecretAccessKey);}public ObjectStorage(IAppConfiguration appConfiguration){_aws3Services = new S3ApiGateway(appConfiguration.BasicCredentials,appConfiguration.As3Config);    }public List<string> GetBucketsList(){return _aws3Services.GetBucketsListAsync().Result;}public async Task<List<string>> GetBucketsListAsync() {try{var getPutBucketResponse=  await GetBucketsList();return getPutBucketResponse.Buckets.Select(s=> s.BucketName).ToList();}catch (Exception e){throw e;}}  private async Task<ListBucketsResponse> GetBucketsList()     {        return await _awsS3Client.ListBucketsAsync();   //In this point throw exceptione     }Share"


Question: Unable to validate an instance profile with the role DataPipelineDefault

"Hi,I am facing a weird issue while trying to set up a DataPipeline via Cloudformation.The Cloudformation yaml file is used to create the two needed Roles ( DataPipelineDefaultRole and DataPipelineDefaultResourceRole ) and its DataPipeline as described in the AWS doc : https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-datapipeline-pipeline.htmlI am using exactly that example including the creation of two Roles by strictly following this AWS tutorial : https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-iam-roles.htmlTo make it short:If I create the two roles via AWS Web Console and then run the CloudFormation process, everything works as expected (datapipeline and all needed resources are properly created).But if I try to include the creation of the roles into the CloudFormation file and skip the Web Console, then I get the below error :Pipeline Definition failed to validate because of following Errors: [{ObjectId = 'EmrClusterForBackup', errors = [Unable to validate an instance profile with the role name'DataPipelineDefaultResourceRole'.Please create an EC2 instance profile with the same name as your resource role]}] and Warnings: [{ObjectId = 'Default', warnings = ['pipelineLogUri'is missing. It is recommended to set this value on Default object for better troubleshooting.]}]So, I have spent hours today trying to debug this issue and can guarantee that the generated Roles are identical either using the Web Console or the CloudFormation definition. I have extracted their json definition via iam get-role command in both cases and they are indeed the same.Can someone help out here ?Best,M.Edited by: tundraspar on Feb 6, 2019 1:22 PMFollowComment"

Answer: "0just compared the Roles details and noticed the one created via CF automation has an extra line (Sid:) which is empty anyway:Role generated via Web Console{    "Role": {        "RoleName": "DataPipelineDefaultRole",        "CreateDate": "2019-02-06T17:22:13Z",        "RoleId": "AROAI2B7HMTSEAUOGJOK4",        "Path": "/",        "Arn": "arn:aws:iam::429416768433:role/DataPipelineDefaultRole",        "AssumeRolePolicyDocument": {            "Version": "2012-10-17"            "Statement": [                {                    "Effect": "Allow",                    "Principal": {                        "Service": [                            "elasticmapreduce.amazonaws.com",                            "datapipeline.amazonaws.com"                        ]                    },                    "Action": "sts:AssumeRole"                }            ],        },    }}Role generated via CF{    "Role": {        "RoleName": "DataPipelineDefaultRole",        "CreateDate": "2019-02-06T17:46:25Z",        "RoleId": "AROAJGHEOSAQTO6DWRNWY",        "Path": "/",        "Arn": "arn:aws:iam::429416768433:role/DataPipelineDefaultRole",        "AssumeRolePolicyDocument": {            "Version": "2012-10-17",            "Statement": [                {                    "Effect": "Allow",                    "Principal": {                        "Service": [                            "datapipeline.amazonaws.com",                            "elasticmapreduce.amazonaws.com"                        ]                    },                    "Action": "sts:AssumeRole",                    "Sid": ""                }            ]        }    }}Can it interfere somehow ?CommentSharetundrasparanswered 4 years ago0After having spent hours on this, I found out that there is a need to create the instanceProfile (manually or via CM if you use any automation tools like ansible, terraform or chef).The AWS documentation was a bit misleading as the Emr cluster definition field specifies to provide the resourceRole whereas the instanceProfile previously created was meant to be set there.Here is my terraform procedure :data "aws_iam_policy_document" "ec2_assume_role" {  statement {    effect = "Allow"    principals {      type        = "Service"      identifiers = ["ec2.amazonaws.com","datapipeline.amazonaws.com","elasticmapreduce.amazonaws.com"]    }    actions = ["sts:AssumeRole"]  }}resource "aws_iam_role" "emr_ec2_instance_profile" {  name               = "MyInstanceProfile"  assume_role_policy = "${data.aws_iam_policy_document.ec2_assume_role.json}"}resource "aws_iam_role_policy_attachment" "emr_ec2_instance_profile1" {  role       = "${aws_iam_role.emr_ec2_instance_profile.name}"  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role"}resource "aws_iam_role_policy_attachment" "emr_ec2_instance_profile2" {  role       = "${aws_iam_role.emr_ec2_instance_profile.name}"  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole"}resource "aws_iam_instance_profile" "emr_ec2_instance_profile" {  name = "${aws_iam_role.emr_ec2_instance_profile.name}"  role = "${aws_iam_role.emr_ec2_instance_profile.name}"}In short :create the Policy Documenta IAM RoleTwo Policies attachment MapReduce and DataPipeline (perhaps the first one not needed though)The most important => attach them together with the instanceProfileLet me know if you need more help or get stuckHope it helps!BestCommentSharetundrasparanswered 4 years ago"


Question: Whitelist fields in direct POST without requiring them to be in the form

"I have a form that is doing a direct to S3 post. I have whitelisted the miscellaneous fields on the form, other than the file field, like text boxes, so that AWS won't reject the POST, using allow_any:allow_any: %w(title description client_selectable clients[])My problem is that fields like client_selectable (a checkbox) and clients[] (a select tag) don't send any form data if the checkbox is not checked or nothing selected in the select list. AWS appears to require that the fields I specify with allow_any to be there. I cannot understand why that is so. I can work around it with using hiddens, but it would be much cleaner if I knew how to tell AWS to allow those fields but don't require them.Help?Edited by: JasonSr on Apr 23, 2020 4:39 AMFollowComment"

Answer: "0Did it another way. I just named all my custom fields in the form x-ignore-* and then I also have an x-ignore-post-upload-url which is the action my form submit ultimately goes to. So, when the xhr request completes sending the file to AWS, I do an ajax call to that action and include my form fields as data in the xhr request to my controller.In other words, not using the allow_any policy at all.Edited by: JasonSr on Apr 23, 2020 6:29 AMCommentShareJasonSranswered 3 years ago"


Question: Retain private IP when restoring EC2 instance from AWS Backup or Snapshot

"Hello all.I'm testing restores of an EC2 instance and I've found that it never retains the same private IP, regardless of whether it's restored from AWS Backup or an EC2 snapshot.I've even tried deleting the original instance prior to doing the restore in hopes that the restored EC2 would have the same the private IP as the original (because I know you can't reconfigure the primary private IP of an EC2 or have the same IP on another NIC), but no luck.It would seem this is a pretty basic functionality and concept, as some servers have hardcoded IPs that can't be changed without wrecking production environments.  Am I missing something or is there just absolutely no ability to keep the same private IP when doing a restore?Please advise.FollowComment"

Answer: "0Accepted AnswerYou can specify the IP Address in a Launch Template, specifically AWS::EC2::Launch Template NetworkInterfaceCommentShareRodney Lesteranswered 2 months agoEXPERTTushar_Jreviewed 2 months ago0It's good to avoid the issue using domain names or internal load balancers, but there are some ways of getting the same private IP.One is to use an additional ENI that you attach to your instance in addition to the default ENI.  Other resources can reference the private IP of this additional ENI, which can be detached and attached to another instance as needed.  Note it needs to be in the same AZ but different subnet than the default ENI.Another hack I've heard of is using a very small subnet (/28) and using up all but one of the available IP addresses.  Then when your instance starts it's forced to always use the same IP address.CommentShareEXPERTskinsmananswered 2 months agoskinsman EXPERT2 months agoThanks for adding the much better answer @Rodney Lester.  My info was way out of date - somehow in the shift from Launch Configurations to Launch Templates years ago I never noticed (or have forgotten) that specifying a primary IPv4 address is now possible.  Cheers.Share"