Question: AWS SES quotas related to email receiving

It is unclear in the AWS SES Quota Documentation whether there are any limits on the number of emails received. What are the message per minute/day limits?FollowComment

Answer: "0Hello,There are no published quotas on the amount of emails you can receive with SES.  The only receiving quotas are listed under the Quotas related to email receiving section on the link you listed here.CommentShareEXPERTChris_Ganswered a year ago"


Question: AWS WAF - protecting resources in another account

"Hi all, is it possible to protect say a Cloudfront distro that's in a different account to the one that the WAF is in, please?For example, can I add a load balancer into the remit of the WAF from another account?thanks,MattFollowComment"

Answer: "2You can do it using AWS Firewall Manager - Using AWS Firewall Manager, you can easily roll out AWS WAF rules for your Application Load Balancers, API Gateways, and Amazon CloudFront distributions.https://aws.amazon.com/firewall-manager/?nc1=h_lsThere is some requirements to be able to use The AWS Firewall Manager, you must use AWS Organizations (https://aws.amazon.com/organizations/) and have AWS Config (https://aws.amazon.com/config/) set on all accounts.CommentShareDouglas_Lanswered a year ago0Accepted AnswerYou must use an AWS WAF WebACL in the same account as the resource that you want to protect - whether that's a CloudFront distribution or an ALB. However, as mentioned in a previous answer, you can use AWS Firewall Manager to centrally manage AWS WAF WebACLs across your entire AWS Organization.CommentSharePaul_Lanswered a year ago0Looks like I will need VPC Peering I think at minimum to do this.CommentSharemattmulleranswered a year ago"


Question: Fail to connect to RabbitMQ

"Hello,I'm trying to connect to a non-public RabbitMQ using nodejs and I keep getting the following error no matter what I've tried...Error: Handshake terminated by server: 403 (ACCESS-REFUSED) with message "ACCESS_REFUSED - Login was refused using authentication mechanism PLAIN. For details see the broker logfile.All docs for RabbitMQ + SSL stating the use of certificates. However, and AFAICT, cert authentication is not currently supported on AmazonMQ.So my question is, what exactly is needed in order to successfully connect to a RabbitMQ broker over SSL on AmazonMQ.Example of nodejs with amqplib would be highly appreciated.Thanks!Edited by: karadikid on May 31, 2021 8:02 AMFollowComment"

Answer: "1What was the solution?CommentShareahm3danswered 2 years ago-1Managed to resolve it by myself, feel free to close\delete.Thanks!CommentShareEXPERTkaradikidanswered 2 years ago"


Question: Hyper-V on EC2 without dedicated host

"Hi,i would like to activate hyper-v on ec2 with shared instance and not dedicated host.is supported?FollowComment"

Answer: 1You can only run Hyper-V Server or Windows Server with Hyper-V on bare metal instance .Hyper-V is currently not supported on EC2 instance.CommentShareMike_Lanswered a month ago


Question: Route53 to replace MS AD DNS

"A customer is running their Active Directory DC on EC2 and DNS services on the same domain controller, now they are assessing migrating the DNS service from DC EC2 to Route53 and are asking if there will be missing any gap in features (like kerberos, srv, etc..), I am looking for any previous experience in moving AD DNS to route53 and if we have any assessment/comparison?FollowComment"

Answer: "0Accepted AnswerRoute 53 does support SRV records.  A full list is here:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.htmlRoute 53 Resolver and Route 53 Private DNS are purely DNS services.   These services do not implement higher level Active Directory functions like Kerberos.  That said,  Kerberos is known to be quite sensitive to DNS entries being set up in a certain way (eg reverse lookup matching forward name).    And AD does that transparently.  In principle, you should be able to create the correct view of DNS in Route 53, but that may take some effort.One way forward is to use Route 53 Resolver (ie the VPC's .2 address) on all instances for DNS resolution.  Then create an outbound endpoint in the VPC where the AD Servers are and create forwarding rules to forward only those namespaces which the AD servers directly manage (both forward and reverse probably) to the IPs of the AD servers.  The result should be that all queries for instance names, Private Hosted Zones, Private Link endpoints, AWS APIs and public names are served directly by Route 53 Resolver.   The AD servers will receive queries only for the names they directly manage.  The customer does not have to replicate AD's DNS management in Route 53 Private DNS.Advantages of this approach are that the Route 53 Resolver should be more highly available and scalable compared to the DNS service provided by the AD servers (which are individual instances).  In the worst case, if the AD server instances were to fail, most DNS would continue to work, except for those namespaces which forward to the AD servers.CommentShareEXPERTgavinmcanswered 4 years ago"


Question: RDS permissions bug report with PostgreSQL 15

"Database owner does not have (implicit) usage permissions for pg_database_owner unless triggered by "related" query.First false, then trueinitech=> \conninfoYou are connected to database "initech" as user "initech_admin" on host "initech.cthulhu4u2u1.us-east-1.rds.amazonaws.com" (address "10.108.77.201") at port "5432".SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, compression: off)initech=> SELECT  pg_catalog.pg_has_role('initech_admin', 'pg_database_owner', 'member') AS member,  pg_catalog.pg_has_role('initech_admin', 'pg_database_owner', 'usage') AS usage; member | usage--------+------- t      | f(1 row)initech=> SELECT  pg_catalog.pg_has_role('initech_admin', 'pg_database_owner', 'member') AS member,  pg_catalog.pg_has_role('initech_admin', 'pg_database_owner', 'usage') AS usage; member | usage--------+------- t      | f(1 row)initech=> SELECT  pg_catalog.pg_has_role('initech_master_user', 'pg_database_owner', 'member') AS member,  pg_catalog.pg_has_role('initech_master_user', 'pg_database_owner', 'usage') AS usage; member | usage--------+------- t      | t(1 row)initech=> SELECT  pg_catalog.pg_has_role('initech_admin', 'pg_database_owner', 'member') AS member,  pg_catalog.pg_has_role('initech_admin', 'pg_database_owner', 'usage') AS usage; member | usage--------+------- t      | t(1 row)Note from the \conninfo, the active role in the session is initech_admin. The usage=f is consistent until the initech_master_user query occurs, after which usage=t is consistent. Note the initech_master_user is the RDS master user for this PostgreSQL instance and that role has been granted initech_admin:initech=> \du initech_master_user                                    List of roles      Role name      |          Attributes           |           Member of---------------------+-------------------------------+------------------------------- initech_master_user | Create role, Create DB       +| {initech_admin,rds_superuser}                     | Password valid until infinity |initech=> \l initech                                                 List of databases   Name  |     Owner     | Encoding |   Collate   |    Ctype    | ICU Locale | Locale Provider | Access privileges---------+---------------+----------+-------------+-------------+------------+-----------------+------------------- initech | initech_admin | UTF8     | en_US.UTF-8 | en_US.UTF-8 |            | libc            |(1 row)From non-database ownerIf we connect as a different role initech_app (which is neither the database owner nor the RDS master user), the usage=t returns immediately for the initech_admin role:psql (15.2 (Homebrew))SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, compression: off)Type "help" for help.initech=> \conninfoYou are connected to database "initech" as user "initech_app" on host "initech.cthulhu4u2u1.us-east-1.rds.amazonaws.com" (address "10.108.77.201") at port "5432".SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, compression: off)initech=> SELECT  pg_catalog.pg_has_role('initech_admin', 'pg_database_owner', 'member') AS member,  pg_catalog.pg_has_role('initech_admin', 'pg_database_owner', 'usage') AS usage; member | usage--------+------- t      | t(1 row)Note this role is not a member of any other roles (and from the above, is not the database owner):initech=> \du initech_app                      List of roles  Role name  |          Attributes           | Member of-------------+-------------------------------+----------- initech_app | Password valid until infinity | {}Comparison to non-RDS PostgreSQLOn the other hand, a Dockerized PostgreSQL does not have this issue:initech=> \conninfoYou are connected to database "initech" as user "initech_admin" on host "127.0.0.1" at port "16077".initech=> SELECT  pg_catalog.pg_has_role('initech_admin', 'pg_database_owner', 'member') AS member,  pg_catalog.pg_has_role('initech_admin', 'pg_database_owner', 'usage') AS usage; member | usage--------+------- t      | t(1 row)Note the database is set up in roughly the same way:initech=> \du initech_master_user                             List of roles      Role name      |          Attributes           |    Member of---------------------+-------------------------------+----------------- initech_master_user | Create role, Create DB       +| {initech_admin}                     | Password valid until infinity |initech=> \l initech                                                 List of databases  Name   |     Owner     | Encoding |   Collate   |    Ctype    | ICU Locale | Locale Provider | Access privileges---------+---------------+----------+-------------+-------------+------------+-----------------+------------------- initech | initech_admin | UTF8     | en_US.UTF-8 | en_US.UTF-8 |            | libc            |(1 row)FollowComment"


Question: Access FSx for Windows over the public internet?

A customer is interested in accessing FSx for Windows from remote clients and their office network without using VPN since they only have a few users and are not storing sensitive data.Is it possible to expose FSx over public internet? It seems that FSx only gets assigned a private IP.Are there any workarounds that can be done that will be cheaper than running VPN?Thank You!FollowComment

Answer: "0Accepted AnswerExposing to the internet would not be recommended, for any type of data unless it's meant to be publicly consumed.it may be less costly to run a self managed S2S VPN or Client to site VPN and access FSx that way. They could alternatively leverage a bastion host in AWS secured to the IP Range of their corp offices, to log onto to access FSX without a VPN.CommentShareEXPERTRob_Hanswered 3 years agorePost-User-7725068 a year agoHi Rob, How about accessing FSX from a Windows EC2 but not joined to the domain. Possible to access using UNC path of FSX share and providing the credentials? Please advise.Share"


Question: Individual file to be restore from FSX file system

Is it possible to recover individual file or folder from FSX file system.FollowComment

Answer: "2You will need to restore the backup to a new FSx file system, retrieve the target file(s), then delete the restored filesystem. See Restoring backupsCommentShareEXPERTkentradanswered a year ago1Accepted AnswerYou cannot restore individual files or folders from an FSx backup. However, you can use an available backup to create a new file system and then access the files you need.  Restoring a backup to a new file system takes the same amount of time as creating a new file system, and the data restored from the backup is lazy-loaded onto the file system - so this can still be an efficient way to restore a single file or folder.CommentShareNikhil Srivastavaanswered a year ago1Hi, good questionAs per the documentation https://docs.aws.amazon.com/aws-backup/latest/devguide/restoring-fsx.htmlNoteYou can't restore to an existing Amazon FSx file system, and you can't restore individual files or folders.CommentShareSrianswered a year agoAWS-User-6176623 a year agobut is there any way to enable this behavior.Share"


Question: AWS S3 - File access only allowed when coming from a specific domain

HiI've added a PDF file to a bucket. I only want people to be able to view it if they are visiting from a specific domain name. If someone had the actual link they wouldn't be allowed to view it unless they were logged in on the allowed domain.Mank thanksFollowComment

Answer: "0HiThanks for this info. I'm really new to AWS & S3. I looked at the Limiting access to specific IP Addresses help doc and noticed Restricting access to a specific HTTP referer. I've played around with that and can get that to only allow access if the user is coming from the allowed domain.The help doc says to be careful with aws:Referer. Would you say what I am doing could be dangerous?I modified the sample policy i.e.{"Version":"2012-10-17","Id":"http referer policy example","Statement":[{"Sid":"Allow get requests originating from www.example.com and example.com.","Effect":"Allow","Principal":"","Action":["s3:GetObject","s3:GetObjectVersion"],"Resource":"arn:aws:s3:::DOC-EXAMPLE-BUCKET/","Condition":{"StringLike":{"aws:Referer":["http://www.example.com/","http://example.com/"]}}}]}CheersCommentShareKeithanswered a year agokentrad EXPERTa year agoIt is so easy for the client to set the Referer value to what ever they want. It really does not limit access from those domains.Share0I don't think it is possible to restrict from a particular domain but you can restrict the GetObject request to only a set(s) of CIDR addresses. See: Limiting access to specific IP addressesIf you fronted the bucket with CloudFront, you could do something similar using a WAF rule.CommentShareEXPERTkentradanswered a year agoEXPERTToni_Sreviewed a year ago"


Question: Segregation for mutually-exclusive systems/environments

"One thing that bothered me right from the beginning learning about X-Ray is no native construct to define segregated whole systems and environments. An AWS account can be used to host multiple non-related or mutually-exclusive entire systems, and other services like VPC, EC2, S3, etc provide the necessary "fencing" features to keep them cleanly apart and secure.X-Ray on the other hand, seems to just want to collect traces from all sources and dump everything into a single "bucket". Even if we define highly elaborate annotation protocols to clearly differentiate the systems/environments, what's to stop a team from looking at another team's traces and possibly sensitive data?FollowComment"

Answer: "0Hi icelava,AWS strongly recommends the usage of separate accounts for systems that are unrelated, especially if users of one system should not have visibility into another because of data sensitivity. See this article for a more in-depth explanation of multi-account architectures: https://aws.amazon.com/organizations/getting-started/best-practices/One alternative that you alluded to for viewing different collections of traces separately within the same account is X-Ray Groups: https://docs.aws.amazon.com/xray/latest/devguide/xray-console-groups.htmlUsing X-Ray groups, you can pre-define a filter expression to view the service map and trace list for only traces with a certain attribute, like an annotation or segment name. This way as long as all of your subsystems are sending data to the same account with some distinguishing attribute, each team can have a Group that filters only for the traces of their subsystem/environment. As you pointed out though, this does NOT prevent teams from potentially seeing each other's groups, so if data sensitivity is a major concern then multi-account architecture is the best approach.CommentShareAWS-User-2079090answered 2 years ago0I don't know; when one looks at the highly elaborate and flexible feature set of IAM policies and permissions in conjunction with other AWS services, a one-size-fits-all X-Ray service really appears like a product that was rushed to market.Does it make sense to state anybody with access to an AWS account should be able to read/write to all S3 buckets and files?Edited by: icelava on Nov 10, 2021 4:46 AMCommentShareicelavaanswered 2 years ago0Hi icelava,Thank you for the feedback, we understand the current architecture of X-Ray has limitations around fine-grained control for accessing data and the workarounds I described are not sufficient for cases involving sensitive data. I will file a formal feature request for this use case so our product team has it in on their radar, and update this issue if it is on our roadmap.CommentShareAWS-User-2079090answered 2 years ago0"Wait for roadmap"CommentShareicelavaanswered 2 years ago"


Question: Oracle Active Data Guard on AWS

A customer intends to run Oracle Active Data Guard to protect their Oracle DB across 2 AZs. What is your experience to take how long to switchover (more than 95 TB) to another Standby Oracle DB if the primary Oracle DB is malfunction? Thank you.FollowComment

Answer: "0Accepted AnswerConsidering that database size is 95TB, I assume customer is going to run it on EC2. (RDS can only support 64TB max size).For oracle on EC2, time to switch over is heavily dependent on the inflight transactions during the cut over time.  This also depends on the tooling by customer on 1/failure detection 2/automate fail over process and 3/DNS changes - application changes.With Oracle on EC2, customer has to develop all of this tooling themselves. Oracle has quite a few best practices published in this regard and these have been battle tested by Oracle DBA's for years.Thanks,CommentShareRavi_Manswered 4 years ago"


Question: Replacing awscli v1 with awscli v2 on Windows 10

"I have awscli version 1.27.115 using pip.  My python version is 3.9.  I want to update it to awscli v2.  All the links on AWS mention to remove it from Add / Remove panel and then install awscliv2 but I don't see AWS Command Line in the Control Panel Add / Remove programs.  How can I proceed?  Also,  I can't use msi to install awscliv2 as msi requires admin access and I don't have admin on the machine.   I will have to use pip to do so.One other piece of information - I have awscli version installed in 2 placesI have python in two places - H:\Software\Python3.9 - version 3.9.7C:\Software\Python3.9 - version 3.9.13 and C:\Utilities\venvs39\gluevenv is virtual env from C:\Software\Python3.9H:\Software\Python3.9>where awsC:\Utilities\venvs39\gluevenv\Scripts\awsC:\Utilities\venvs39\gluevenv\Scripts\aws.cmdH:\Software\Python3.9\Scripts\awsH:\Software\Python3.9\Scripts\aws.cmdI think I will have to remove the awscliv1 from both the places.Can I remove awscli v1 using pip uninstall and then install v2 again using pip install?ThanksFollowComment"

Answer: "0Yes, you can unistall AWS CLI v1 using  the following command:pip3 uninstall awscliorpip uninstall awscliMore  information about uninstalling AWS CLI v1 on the following documentation: https://docs.aws.amazon.com/cli/v1/userguide/install-windows.html#awscli-install-windows-pip:~:text=Uninstall%20the%20AWS%20CLI%20version%201%20using%20pipAfter it has been uninstalled, then you can install AWS CLI v2 using the following instructions: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html#:~:text=Install%20or%20update%20the%20AWS%20CLICommentSharevtjeananswered a month agoadbdkb a month agoWhen I did pip uninstall awscli, it uninstalled only from one location and then when I tried to execute that again, hoping, it will uninstall from the second location, it gave error.  But, if I tried was --version, it didn't work either.    So, I just physically deleted the folders from the second location to remove awscli completely.   To install awscliv2 on Windows, the 'pip install awscliv2' doesn't seem to work.  I doesn't give any error, but that doesn't actually get installed either.  We don't have admin accesses on our machines and psi requires admin access.  I worked with our desktop team, to get awscliv2 installed on my windows vdi.Share"


Question: Amazon RDS SSL/TLS Certificate will be rolled back after updated

I already updated CA Certificate up to rds-ca-2019 then I created a snapshot of that but my CA Certificate became rds-ca-2015 when I was restoring created snapshot. did I missed something?FollowComment

Answer: "0Snapshots are considered new instances when they are restored so they will have the old certificates by default. Starting on January 14, 2020, however, all snapshots will receive the new certificates.CommentShareAWS-User-0584059answered 3 years ago0thanks so much.CommentSharedatdt201answered 3 years ago"


Question: Being charged double for light sail instance

"Hi All,I am using following LightSail instance (only 1):Amazon Lightsail Bundle:4GBwhich should have been charged $20.But I am being charged double the amount, here is what is written in billing for this one instance:$0.0269 / Hour of 4GB bundle Instance 1,488 HrsUSD 40.00FollowComment"

Answer: "0Are you sure you are not activating two units?1,488 Hrs, so it looks like you are running 2 units.CommentShareEXPERTRiku_Kobayashianswered a month ago0Lightsail plans are billed on an on-demand hourly rate, so you pay only for what you use. For every Lightsail plan you use, we charge you the fixed hourly price, up to the maximum monthly plan cost. Therefore if the bill is for $40, there is a good chance you are running two 4 GB Memory bundle instances. For further questions on billing, please refer to the "Billing and Account Management section" in our FAQ page. https://aws.amazon.com/lightsail/faq/.Please reach out to customer support if you have any questions.CommentShareAWS-User-5087265answered a month ago"


Question: "Jenkins installed on EC2 instance, but, it doesn't seem to work. Jenkins status says active but nothing runs on port 8080"

"I have installed jenkins on AWS EC2 instance, followed this article.https://www.jenkins.io/doc/tutorials/tutorial-for-installing-jenkins-on-AWS/When I check jenkins status, using "sudo service jenkins status"● jenkins.service - LSB: Jenkins Automation ServerLoaded: loaded (/etc/rc.d/init.d/jenkins; bad; vendor preset: disabled)Active: active (exited) since Fri 2022-02-25 12:04:09 UTC; 57min agoDocs: man:systemd-sysv-generator(8)Feb 25 12:04:09 ip-172-31-33-61.ap-south-1.compute.internal systemd[1]: Starting LSB: Jenkins Automation Server...Feb 25 12:04:09 ip-172-31-33-61.ap-south-1.compute.internal jenkins[22299]: Starting Jenkins [  OK  ]Feb 25 12:04:09 ip-172-31-33-61.ap-south-1.compute.internal systemd[1]: Started LSB: Jenkins Automation Server.But when I use "telnet localhost 8080", it saysTrying 127.0.0.1...telnet: connect to address 127.0.0.1: Connection refusedand "sudo netstat -anlp | grep 8080" gives no output.Can someone please help me with this?Thank you.FollowComment"

Answer: "1Hello Rakshith,According to the sudo service jenkins status output that you've posted, it looks like your Jenkins process has exited due to a possible error.Active: active (exited) since Fri 2022-02-25 12:04:09 UTC; 57min agoAs the process exited, you are not able to connect to the port 8080.To find out more about the issue, you can run the below command and check for any errors that could have contributed to the issue.sudo journalctl -u jenkinsI hope this is helpful!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered a year ago"


Question: "What fonts, if any, are available in Lambda?"

"There's a lot of information on how to install fonts, but I've not found any listing which fonts are available by default.FollowComment"

Answer: "0Accepted AnswerLambda does come with the option to choose between available runtimes as well imperatively selects the underlying OS (Amazon Linux/Amazon Linux 2) based on the selected runtime. Depending on the underlying OS, there might not be any fonts be available and installing the specific fonts that you need in a separate directory along with a fonts.conf file should be the suggested path forward.CommentShareEXPERTParnabanswered 2 years ago"


Question: Problem with sending email with Workmail

"Hey Community,This is my first post here =) I hope I'm asking the right question in the right section!I'm slowly moving away from my hoster and using AWS more and more.I have a Lightsail instance where I now have my website on it. The domain is still with the hoster and is redirected to AWS in the name server.Of course, the domain also has "several" email addresses.For this I set up Amazon SES and also Workmail.The domain and the email addresses also have the status "Verified"Unfortunately, it is the case that not necessarily "all" messages are sent or even arrive.A few days ago a customer sent me an email that could not be delivered.However, if he replied to an existing email, it was delivered.Yesterday I replied to another customer's message. This message was not delivered either.Unfortunately, I have absolutely no idea where to "check" what.Maybe one of you can help me?!Thank you and best regardsMrThiemannFollowComment"

Answer: "1Hi,I'm sorry to hear you're experiencing some problem with receiving some mails. Here are some tips to troubleshoot your mail flow:MX domain recordMake sure WorkMail is the only server in the MX record. Other servers in the records might cause messages to go to other services where your mailbox does not exist. So only add WorkMail (with the correct region) to you MX record.SES inbound rulesCheck that the SES inbound rules that are added next to the WorkMail rule function correctly. If a rule with an action other than WorkMail fails it can lead to following rules to not be executed and mails not ending up in WorkMail.Mail rulesEmail rules on the organization or mailbox level can alter the direction of the mail or even delete it. You can verify the Mail flow rules on the organization level using the rule test function. You can also enable message logging to verify incoming mail and what happens during its delivery. This is also the way to verify if any mailbox level rules are executed. More on message logging can be found here.DMACR enforcementWorkMail can enforce DMARC rules set by sender. This is a feature to combat abuse of domains by spamers but if incorrectly configured by the sender it can lead to WorkMail dropping mail or delivering to junk. You can verify this via message logging.Bounce messagesIf email does not arrive, it can be the the sender receives a bounce message. This message should include the error it encountered and can help in finding the root cause of the problem.I hope these steps can help you troubleshoot you mail set-up.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 9 months ago"


Question: IPS in use in a subnet

"Hello, i need to know which IPs are currently in use in each subnet and what they are assigned to. How can i see this info in GUI or CLI? thanksFollowComment"

Answer: "0IPAM as @Gary Mclean suggested is recommended (albeit expensive!) for ongoing management of IPs but are you wanting just to query current state?  If so, have a look in the EC2 Console under "Network Interfaces".  Similar information is available via the CLI with aws ec2 describe-network-interfaces - see https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-network-interfaces.html.CommentShareEXPERTskinsmananswered 14 days agorePost-User-0589405 14 days ago@skinsman thanks for that. what i am trying to do is to find out which ips are currently assigned in each subnet. something like sh IP interface for a router. is that do able?Share0I believe the recommended solution would be to use IPAMhttps://docs.aws.amazon.com/vpc/latest/ipam/what-it-is-ipam.htmlCommentShareGary Mcleananswered 14 days ago"


Question: log4j2 with AWS EMR and Spark

"I have a spark application which logs output to my console with this:logger.info("Hello world")My problem is, the log output is nowhere to be found after running the spark app in an EMR cluster.When I create a cluster and submit a spark job, I specify the LogUri (S3 bucket) but I get nothing.I submit my spark job with: https://docs.aws.amazon.com/aws-sdk-php/v3/api/api-elasticmapreduce-2009-03-31.html#runjobflowstderr for the spark job showsSLF4J: Class path contains multiple SLF4J bindings.SLF4J: Found binding in [jar:file:/usr/lib/hadoop/lib/slf4j-log4j12-1.7.10.jar!/org/slf4j/impl/StaticLoggerBinder.class]SLF4J: Found binding in [jar:file:/usr/lib/spark/jars/slf4j-log4j12-1.7.16.jar!/org/slf4j/impl/StaticLoggerBinder.class]SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.SLF4J: Actual binding is of type [org.slf4j.impl.Log4jLoggerFactory]ERROR StatusLogger Log4j2 could not find a logging implementation. Please add log4j-core to the classpath. Using SimpleLogger to log to the console...20/03/07 19:20:39 INFO ShutdownHookManager: Shutdown hook called20/03/07 19:20:39 INFO ShutdownHookManager: Deleting directory /mnt/tmp/spark-xxxxxxxxCommand exiting with ret '0'How do I solve this?Attached is my log4j2.properties file (renamed for uploading to this discussion)Edited by: ErickN on Mar 7, 2020 12:02 PMFollowComment"

Answer: "0Must use log4j version 1.  It's supported by spark and EMR.Edited by: ErickN on Mar 13, 2020 7:38 AMCommentShareErickNanswered 3 years ago"


Question: How to use CDK without using CDKToolkit

"We use CDK to build infrastructure in the customer's AWS environment. However, It is prohibited to create IAM resources in customer's AWS environment.Therefore, CDKToolkit cannot be deployed because CDKToolkit in CDK v2 contains IAM resources.Is there any way to use CDK without CDKToolkit or in the stack without including IAM in CDKToolkit?FollowComment"

Answer: "2Probably the best thing to do is provide your clients a CloudFormation template that they can use to bootstrap the account for you. The following command will generate a CDK bootstrap template (note: it's a good idea to add a qualifier to the toolkit so you don't conflict with other toolkits in the same account)cdk bootstrap --qualifier acme-corp --show-template > bootstrap-template.yamlThere are 4 required roles (deployment, file asset, image asset and cloudformation exec). CDK will lookup these roles by their names. Whatever principal you authenticate to your client's account with must have access to assume the deployment role.Note that the cloudformation exec role has excessive access by default.But, if you really want a way around this I would look at creating a custom synthesizer. I've never done this before but I think you could set all 4 roles to be the same principal you already have access to:https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html#bootstrapping-custom-synthCommentSharewdavjonesanswered a year agoMichael_K a year agoFYI in CDK V2 cli you can use the --trust parameter to allow assuming the role from another account.https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html#bootstrapping-customizingShare1Hi there, thank you for your question. What you could do, is customise the templates you are deploying using the CDK. For example, refer to the bootstrapping guide: https://docs.aws.amazon.com/cdk/v2/guide/bootstrapping.html You can get the bootstrap-template.yaml by using this command:cdk bootstrap --show-template > bootstrap-template.yamlYou can then edit the bootstrap-template.yaml file according to your needs, and deploy it yourself. If you choose to create those roles yourself, you can refer to them in the CloudFormation template.CommentShareGeroen_AWSanswered a year ago0It's possible to use CDK, run cdk synth to generate the Cloudformation, and to use that to deploy without the bootstrap stack. This was done with CDKv1.It's slightly painful, but I have needed to do this in the past where the environment required 'pure' CloudFormation deployment via CodePipeline and assuming a role within the target account wasn't permitted.The CDK stack was synthesised, then aws cloudformation package was used to upload the stacks and assets to the single deployment bucket the organisation deploy setup uses.Some resources had to be imported with different resource types, in particular VPCs and Route53 domains. Sometimes when importing you had to use features of CDK.Token to reassure the process an imported value was a number.As was suggested by another poster, a Custom Bootstrapping setup may be the appropriate way to do this.CommentSharecloudandmediaanswered a year ago-2Hi,We strongly recommend against using your main AWS account for day-to-day tasks. Instead, create a user in IAM and use its credentials with the CDK.The CDK Toolkit needs to know your AWS account credentials and the AWS region into which you are deploying, not only for deployment operations but also to retrieve context values during synthesis. Together, your account and region make up the environment.refer- https://docs.aws.amazon.com/cdk/v2/guide/cli.htmlCommentSharelearn2skillsanswered a year ago"


Question: blue/green deployment technique with aurora and replication failure

"I was testing the blue/green deployment technique, which works fine with idle clusters but fails replication with some DDL when the deployment is running.For example, while the Green cluster deployment was in progress, I created the databases, and the replication in the green primary failed.5.6.10-log AURORA_VERSION 1.22.5mysql> create database mytest10; Query OK, 1 row affected (0.01 sec)5.7.12 AURORA_VERSION 2.11.0           ..._IO_Running: Yes            ..._SQL_Running: No mysql.rds_replication_status,mysql.rds_monitor,mysql.rds_sysinfo,mysql.rds_configuration,mysql.rds_history      Replicate_Wild_Do_Table:  Replicate_Wild_Ignore_Table:                   Last_Errno: 1007                   Last_Error: Error 'Can't create database 'mytest10'; database exists' on query. Default database: 'mytest10'. Query: 'create database mytest10'FollowComment"

Answer: "0Testing with create table also failed the replication:                  Last_Error: Error 'Table 'author11' already exists' on query. Default database: 'mytest10'. Query: 'CREATE TABLE `author11` (  `id` int NOT NULL AUTO_INCREMENT,  `first_name` varchar(50),  `last_name` varchar(50),  `email` varchar(100) CHARACTER SET utf8 COLLATE utf8_unicode_ci NOT NULL,   PRIMARY KEY (`id`),  UNIQUE KEY `email` (`email`)) ENGINE=InnoDB'CommentShareArunanswered 5 months ago"


Question: CANNOT Access Workman Organizations!!

"The 'new' console does not have ANY of my existing organizations. I can't manage any email accounts, the only option is to create a NEW Organization!! I have 4 organizations already existing and NO WAY to access them. Help!!!FollowComment"

Answer: "2Hi,I'm sorry to hear you're experiencing problems with finding your organizations. could it be that your console is set to a different region? You can change the region in the top menu bar.Kind regards,RobinCommentShareMODERATORrobinkawsanswered a year ago1Howdy,Sounds like 1 of 2 things is happening:You're logging into an AWS account which doesn't have the expected AWS Workmail organisations, orMoving to the new AWS Management Console has changed your default region to something else (probably Ohio).Moving to the new console wouldn't remove any configurations or AWS resources that you have provisioned, so it has to be one of the above.If the two options above don't line-up for you, then what I would suggest is that you check with a colleague who still has access to the Workmail organisations, and do a comparative check between the account and region that you're in and the account and region that your colleague is in.CommentShareCiaran Carragheranswered a year ago0Thanks Robin and Ciaran! It was indeed the region. This was incredibly difficult to find, FYI for AWS.CommentShareAWS-User-1421378answered a year ago"


Question: How to query s3 using select

"I have the following set up in the gradleimplementation(platform("software.amazon.awssdk:bom:2.18.25"))implementation("software.amazon.awssdk:s3")implementation("software.amazon.awssdk:url-connection-client")my clientS3Client client = S3Client.builder()         .region(Region.of("eu-west-1"))         .credentialsProvider(StaticCredentialsProvider.create(AwsBasicCredentials.create("xxxxxxxx", "xxxxxxx")))         .httpClient(UrlConnectionHttpClient.builder().buildWithDefaults(                 AttributeMap.builder().put(TRUST_ALL_CERTIFICATES, Boolean.TRUE).build()))         .build();And im trying to make a query requestSelectObjectContentRequest request = SelectObjectContentRequest.builder() .bucket(bucket) .key(key) .expression(query) .expressionType(ExpressionType.SQL)         .build();here is where i am stuck, as im not sure which s3 client i should use. I have been using the above client - S3Client.builder. But that does not have any method that takes in SelectObjectContentRequest as a request object.How can i get a s3Client for java 2 sdk to use this SelectObjectContentRequest  ?FollowComment"

Answer: "0The following Java code returns the value of the first column for each record that is stored in an object that contains data stored in CSV format. It also requests Progress and Stats messages to be returned. You must provide a valid bucket name and an object that contains data in CSV format.For instructions on creating and testing a working sample, see Testing the Amazon S3 Java Code Examples.package com.amazonaws;import com.amazonaws.services.s3.AmazonS3;import com.amazonaws.services.s3.AmazonS3ClientBuilder;import com.amazonaws.services.s3.model.CSVInput;import com.amazonaws.services.s3.model.CSVOutput;import com.amazonaws.services.s3.model.CompressionType;import com.amazonaws.services.s3.model.ExpressionType;import com.amazonaws.services.s3.model.InputSerialization;import com.amazonaws.services.s3.model.OutputSerialization;import com.amazonaws.services.s3.model.SelectObjectContentEvent;import com.amazonaws.services.s3.model.SelectObjectContentEventVisitor;import com.amazonaws.services.s3.model.SelectObjectContentRequest;import com.amazonaws.services.s3.model.SelectObjectContentResult;import java.io.File;import java.io.FileOutputStream;import java.io.InputStream;import java.io.OutputStream;import java.util.concurrent.atomic.AtomicBoolean;import static com.amazonaws.util.IOUtils.copy;/** * This example shows how to query data from S3Select and consume the response in the form of an * InputStream of records and write it to a file. */public class RecordInputStreamExample {    private static final String BUCKET_NAME = "${my-s3-bucket}";    private static final String CSV_OBJECT_KEY = "${my-csv-object-key}";    private static final String S3_SELECT_RESULTS_PATH = "${my-s3-select-results-path}";    private static final String QUERY = "select s._1 from S3Object s";    public static void main(String[] args) throws Exception {        final AmazonS3 s3Client = AmazonS3ClientBuilder.defaultClient();        SelectObjectContentRequest request = generateBaseCSVRequest(BUCKET_NAME, CSV_OBJECT_KEY, QUERY);        final AtomicBoolean isResultComplete = new AtomicBoolean(false);        try (OutputStream fileOutputStream = new FileOutputStream(new File (S3_SELECT_RESULTS_PATH));             SelectObjectContentResult result = s3Client.selectObjectContent(request)) {            InputStream resultInputStream = result.getPayload().getRecordsInputStream(                    new SelectObjectContentEventVisitor() {                        @Override                        public void visit(SelectObjectContentEvent.StatsEvent event)                        {                            System.out.println(                                    "Received Stats, Bytes Scanned: " + event.getDetails().getBytesScanned()                                            +  " Bytes Processed: " + event.getDetails().getBytesProcessed());                        }                        /*                         * An End Event informs that the request has finished successfully.                         */                        @Override                        public void visit(SelectObjectContentEvent.EndEvent event)                        {                            isResultComplete.set(true);                            System.out.println("Received End Event. Result is complete.");                        }                    }            );            copy(resultInputStream, fileOutputStream);        }        /*         * The End Event indicates all matching records have been transmitted.         * If the End Event is not received, the results may be incomplete.         */        if (!isResultComplete.get()) {            throw new Exception("S3 Select request was incomplete as End Event was not received.");        }    }    private static SelectObjectContentRequest generateBaseCSVRequest(String bucket, String key, String query) {        SelectObjectContentRequest request = new SelectObjectContentRequest();        request.setBucketName(bucket);        request.setKey(key);        request.setExpression(query);        request.setExpressionType(ExpressionType.SQL);        InputSerialization inputSerialization = new InputSerialization();        inputSerialization.setCsv(new CSVInput());        inputSerialization.setCompressionType(CompressionType.NONE);        request.setInputSerialization(inputSerialization);        OutputSerialization outputSerialization = new OutputSerialization();        outputSerialization.setCsv(new CSVOutput());        request.setOutputSerialization(outputSerialization);        return request;    }}Source: https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-select.htmlLet me know if this helps.CommentShareDylan Souvageanswered 6 months agorePost-User-9510810 6 months agoThanksBut does that mean i have to use V1 of the SDK, is there an example with version 2 of the SDK?ShareDylan Souvage 6 months agoNo, you should be able to use V2, here's some example code for V2https://github.com/awsdocs/aws-doc-sdk-examples/blob/main/javav2/example_code/s3/src/main/java/com/example/s3/ListObjects.javaSource: https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/examples-s3-objects.htmlLet me know if this helps. If it does, please accept my answer :)Share0@Dylan Souvage Where in the V2 documentation is the S3 select / selectObjectContent described?CommentSharerePost-User-9363279answered 2 months ago"


Question: aws ecs execute-command fails with errors related to KMS and Cloudwatch

"Hello all.I've deployed ECS Fargate services with enabled execute-command capabilities. When I execute aws ecs execute-command I'm getting following errors:Encountered error while initiating handshake. Fetching data key failed: Unable to retrieve data key, Error when decrypting data key AccessDeniedException: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.This was fixed by adding IAM permissions"Action": "kms:Decrypt","Effect": "Allow","Resource": "arn:aws:kms:us-east-2:1234567890:*","Sid": "AllowDecryptData"After that, I get following errorWe couldn't start the session because encryption is not set up on the selected CloudWatch Logs log group. Either encrypt the log group or choose an option to enable logging without encryption.Weird thing is, in Session Manager Preferences all options are set to off. Enabling CloudWatch logging and disabling encryption does not change the behavior.Task role has following permissions:{    "Effect": "Allow",    "Action": [        "logs:CreateLogStream",        "logs:PutLogEvents",        "logs:DescribeLogGroups",        "logs:DescribeLogStreams"    ],    "Resource": "*"}{    "Sid": "",    "Effect": "Allow",    "Action": [        "ssmmessages:OpenDataChannel",        "ssmmessages:OpenControlChannel",        "ssmmessages:CreateDataChannel",        "ssmmessages:CreateControlChannel"    ],    "Resource": "*"}{    "Action": "kms:Decrypt",    "Effect": "Allow",    "Resource": "arn:aws:kms:us-east-2:1234567890:*",    "Sid": "AllowDecryptData"}Additionally AmazonSSMManagedInstanceCore policy is attached to the roleTask Execution role has{    "Sid": "",    "Effect": "Allow",    "Action": [        "logs:PutLogEvents",        "logs:CreateLogStream",        "ecr:GetDownloadUrlForLayer",        "ecr:GetAuthorizationToken",        "ecr:BatchGetImage",        "ecr:BatchCheckLayerAvailability"    ],    "Resource": "*"}Additionally AmazonSSMManagedInstanceCore policy is attached to the roleWhat am I missing?Thank you.FollowComment"

Answer: "0Accepted AnswerHave you associated your log group with a customer managed key (CMK)? Please see Encrypt log data in CloudWatch Logs using AWS Key Management Service. If you set the cloudWatchEncryptionEnabled value as true while creating a cluster, that setting expects the log group to be encrypted with a CMK (KMS key). If you don't need to use that option, you can call UpdateCluster to set cloudWatchEncryptionEnabled as false. Even if you set it as false, Log group data is always encrypted in CloudWatch Logs.CommentShareTaka_Manswered 10 months agorePost-User-4602935 10 months agoHey.Yes, cloudWatchEncryptionEnabled was set to true. After changing it to false, I am able to connect to container.Thank you.Share"


Question: Error "Unable to create the application version" in elastic beanstalk

"I am trying to deploy a new version of my application through the Elastic Beanstalk console , but when I attempt to upload my zip file I am getting an error message in the upload and deploy pop-up which simply says "Unable to create the application version:". I have googled for solutions and the issue for other people seems to be having too many application versions as there is a limit of 500 - I have deleted more than 5 older versions but I am still getting the error. I know the error itself is not very descriptive but would anyone know of a possible cause, or possible further directions for troubleshooting? (e.g. some logs that are somewhere)FollowCommentNathan Joyes a year agoContinued trying to work through this to get the application to upload for deployment to my Elastic Beanstalk applications. Zip file size is under 150MB, I have cleared out all local storage and cookie values. I have also removed all but the last 10 versions of my application ensuring they were in sync, and after "freeing" up space in S3.Watching the browser network traffic in the Web Developer Tools and part of the way through the upload, a number of angular script requests start coming back as 401 errors. These errors occur whether the session has been used, a new login, or if in parallel another AWS page refreshes to update any security token timeouts while the upload is progressing.Any assistance would be appreciated.Sharedozenyommer a year agoHas it ever worked?  If so, has anything changed between deploys?  Bucket permissions look okay?ShareMonsajj a year agoHi! I had the same problem.And the only way I found to get around this problem is to connect via aws(eb) cli, create an application version&deploy through it.This does not solve the problem but allows you to continue working.Links that helped me a lot:https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/eb-cli3-getting-started.htmlhttps://stackoverflow.com/questions/60139095/how-to-upload-and-deploy-zip-file-to-aws-elastic-beanstalk-via-cliShare"

Answer: "0With these kind of errors, it's always useful to check:CloudTrail for any API calls and returned errorsThe browser console to see what call failedBoth can help diagnose the problem.CommentShareEXPERTRaphaelanswered a year ago"


Question: AWS SES prevent exceeding the sending rate

"Hi all,In our application, we send reminder emails to our customers one day before their reservation at exactly 1AM. This means, that we may need to send a 100 or even more emails at once, to different email addresses. We have a scheduled Node JS function, which uses the AWS SDK in our backend to do this.Currently, my maximum send rate is 14 emails per second.So my question is how do I go about preventing to exceed the maximum sending rate per second?FollowComment"

Answer: "0Hello,You can use third-party libraries that help with rate-limiting. I usually write in Python so I use this:https://pypi.org/project/ratelimiter/It seems like Node.js has a few third-party rate-limiting libraries too. Here's one:https://www.npmjs.com/package/limiterCommentShareKrishnaanswered 5 months ago"


Question: UE-OCB entry in Cost Explorer

I am seeing a charge in my Cost Explorer when grouped by API Operation - UE-OCB. When I group by Service - it shows as OCBManagedServices. Can anyone provide guidance on what these charges are for?FollowComment

Answer: "0Hello,I'm sorry for the concern these charges may have caused! Our Accounts team will be able to take a closer look into this for you through the Support Center.Please feel free to create a case here:https://go.aws/3lSNhPX.Regards,- Craig M.CommentShareEXPERTAWS Support - Craiganswered a year ago0OCB means "Out-of-Cycle Billing" charge. This is usually individual to each customer, and I would suggest reaching out to support team (opening support case) to clarify this. Such charges may differ from one customer to another, and are often issued on an individual / one-time basis.CommentShareEXPERTNataliya_Ganswered a year ago"


Question: What and How much will it cost me approximately and what do I need for the website and email and domain

"Hello, I have a big request for you, could you please advise me with:What services do I need when I need to create a domain, an email for this domain and a website that will run both front and backend and it will be a WordPress site. At the same time, I would need automatically increasing storage spaceHow much could it cost me? I read about some queries and the like, but I don't understand it at all and I don't know where and who to turn to, the size of the page could be 3-8 GB max at the beginningThank you :)FollowComment"

Answer: "1It is wonderful to see that you are considering AWS to host you website and email domain! Your best next step is to reach out to Sales Support: https://aws.amazon.com/contact-us/sales-support/ . They will put you in contact with an AWS Account Manager and a dedicated AWS Solutions Architect. The AWS Solutions Architect can then provide you an architecture meeting your specific requirements, based on your cost, security, reliability, performance, and operational requirements. The AWS platform is vast and the services meet different needs. However, let me give you a basic idea to get started:A very simple solution will likely involve Amazon Route53 and Amazon Lightsail. Here is a link to a blog on launching a WordPress Website using Amazon Lightsail Containers: https://aws.amazon.com/blogs/compute/launching-a-wordpress-website-using-amazon-lightsail-containers/.However, the requirements for your WordPress site may be more complex and could involve using CloudFront, EC2, Amazon RDS, Amazon Elastic LoadBalancers, Virtual Private Cloud (VPC), Auto-Scaling, etc. In fact, we have a whitepaper detailing Best Practices for WordPress on AWS: https://aws.amazon.com/blogs/architecture/wordpress-best-practices-on-aws/.For your email domain, you will also likely be looking at Amazon Route53 and using Simple Email Service. Keep in mind, WordPress also provides email plugins, so that may be a better route to go depending on your needs.For expanding storage, it would be good to clarify if you mean the database or the storage capacity of the infrastructure supporting the WordPress website. Amazon Relational Database Service does support storage Auto-scaling.As far as costs, there is not enough information to provide an exact estimate. However, assuming you go with a simple Amazon Route53 deployment ($2-$5), smallest Amazon Lightsail instance ($3.50) and database ($15), and a basic configuration for Simple Email Service ($1.50-9.50), I could end up spending around  $22-$32 per month or so. I wouldn't expect it to be cheaper than that with this configuration, and this is assuming a very primitive setup of WordPress. Once you connect with your AWS Solutions Architect, I would recommend looking into the AWS Pricing Calculator to generate a better estimate: https://calculator.aws/#/.I hope this helps give a sense of direction. If you found this answer helpful, please upvote and accept! Thank you.CommentShareKarl_Canswered 5 months ago"


Question: [ElastiCache] How to figure out the required nodes and instance in ElastiCache

"Hi,I am trying to figure out the required nodes and instance type in ElastiCache.It is because I am trying to reduce the cost of following result by replacing DynamoDB to ElastiCache.I haven't decided should it be Memcached or Redis. However, the DB can be volatile, so I am considering Memcached for upscaling from Auto Detect.The following is is the price calculation and needed data for cost calculation for your reference.Could you please guide me on how to get node number and instance type for ElastiCache?In short, it's about 0.5GB data and there are high frequency of reads and writes.It looks like one node of ElastiCache/Memcached with high tier instance type would suffice, but I would like your advice.Thank you,https://calculator.aws/#/estimate?id=7ab704749c01bf87fbd852425e35d45f7a825d5eTotal: 31,195.07 USDDevices: 60000Average message size: 5800 bytesMessage per min while on: 6Message per month while on: 13024606= 259200Assume users only using IoT devices 10% of all timeMessage per month: 25920Total message instances: 60000 * 25920 = 1555.2 MAssuming only 5% are different data = 77.76 MDynamoDB item size: 6K bytes (including some meta data)Total hot data size = 6KB * 60000 = 352MBAssuming 10ms for each Lambda processing.128MB used for LambdaCold data amount = 77.76 M * 5800 B = 451 GBCompression assumption 10% = 45.1 TBInfrequent access percent 90%Objects per month (100 instances to 1 object): .7776 MRead access of S3: 1% of write: 7.7760 KFollowComment"

Answer: "0Accepted AnswerI would suggest building the Cache on the Redis engine.  ElastiCache redis provides greater resilience(multi-az), scale up/down, and security (encryption in transit).  This article provides a great perspective on how to size your cluster (https://aws.amazon.com/blogs/database/five-workload-characteristics-to-consider-when-right-sizing-amazon-elasticache-redis-clusters/) and I would consider the Graviton based cache nodes (m/r6g).CommentShareMODERATORAWS-User-3530981answered 2 years ago"


Question: Does Amazon QuickSight have a user limit?

"We have several clients with 25,000 to 50,000 employees each. We are thinking of creating users with reader permission in Amazon QuickSight for each of them (the actually number accessing Amazon QuickSight will be much lower).Is there any limit to the number of users an Amazon QuickSight account can create? Can they freely create 100,000+ users without encountering any limits?FollowComment"

Answer: "0Accepted AnswerEach Amazon QuickSight Enterprise edition account can have an unlimited number of user accounts.Please see https://docs.aws.amazon.com/quicksight/latest/user/managing-users-enterprise.html.Each Amazon QuickSight Standard edition account can have up to 100 user accounts, including the AWS root account or IAM account that created the Amazon QuickSight account. Please seehttps://docs.aws.amazon.com/quicksight/latest/user/managing-users-standard.html.CommentShareAWS-User-0806727answered 3 years ago"


Question: Create C++ component in 1.10

"I have to clarify that I don't know to much of C++ I come from Unity and UnrealEngine, how with the version 1.10 can create a component like in this question? The folder in dev/Component/MyProyect isn't there.In the answer they put a NOTE: This answer is deprecated in favor of putting your component in a Gem, not in your Game DLL. The procedure is similar except you register the descriptor for your component in your Gem's AZ::Module code.I don't even know what does that mean, it's that the path I have to follow or it changed I don't know what to do and in the documentation I couldn't find anything.Follow"

Answer: "0Accepted AnswerThe path to Gems is usually something like "/Lumberyard/1.10.0.0/dev/Gems/[GemName]/" but that may vary in the future due to features the devs have mentioned are in the works like custom Gem paths. The example you initially referenced was over a year old and most of the current Gem functionality didn't get released until after that example was provided which is why the author said its somewhat deprecated.Generally when creating a Gem you have a Module Class, a System Component Class and potentially additional Component classes within the Gem. The Module class is generally only used to specify any system components contained in the Gem. The System Components tend to be singletons or Components that are automatically attached to a System Entity and there's probably only one of these and never more as they tend to provide a global service or Gem initialization and aren't meant to be attached to a typical Component Entity such as an Actor in the game world. That System Component would have dependencies such as the MemoryService, NavigationService, etc provided by the Engine that need to be initialized before your Gem can properly initialize. It's possible your System Component class will be largely empty if your Gem is only meant to add Components that get attached to a Component Entity.The example you referenced showed how to create a System Component but the typical Component you add to a custom Component Entity in the Editor will have different Attributes in the Reflect function. The dependencies will be normal Components like a SpawnerComponent, Physics related Components, Mesh Components, Light Components, etc that most typical Entities in the game world might require when you're creating a Slice. The Slice is sort of a prefab representing a tree of Component Entities that represent what gets Spawned by a SpawnerComponent to represent an Actor, Projectile, etc. These are the types of Components your generally creating and adding to a Component Entity in the Editor.SharerePost-User-9435498answered 6 years ago0In essence, if you want to create a component, you create a gem and it will create a template for the gem that includes a component template.To add new components, you modify the gem module source and add in a descriptor of the component.Example Gem Module    namespace Example{class ExampleModule: public CryHooksModule{public:AZ_RTTI(ExampleModule, "<guuid>", CryHooksModule);AZ_CLASS_ALLOCATOR(ExampleModule, AZ::SystemAllocator, 0);OpenDivaModule(): CryHooksModule(){// Push results of [MyComponent]::CreateDescriptor() into m_descriptors here.m_descriptors.insert(m_descriptors.end(), {ExampleSystemComponent::CreateDescriptor()});}/*** Add required SystemComponents to the SystemEntity.*/AZ::ComponentTypeList GetRequiredSystemComponents() const override{return AZ::ComponentTypeList{azrtti_typeid<ExampleSystemComponent>()};}};}As you can see from above, to add a component to the gem you add the descriptor (which is a static function) to the m_descriptors.SharerePost-User-8564951answered 6 years ago0Now for the component itself.Header:    #pragma once#include <AzCore/Component/Component.h>#include <ExampleGem/ExampleGemBus.h>namespace Example{class ExampleSystemComponent: public AZ::Component, protected ExampleRequestBus::Handler{public:AZ_COMPONENT(ExampleSystemComponent, "<guuid>");static void Reflect(AZ::ReflectContext* context);static void GetProvidedServices(AZ::ComponentDescriptor::DependencyArrayType& provided);static void GetIncompatibleServices(AZ::ComponentDescriptor::DependencyArrayType& incompatible);static void GetRequiredServices(AZ::ComponentDescriptor::DependencyArrayType& required);static void GetDependentServices(AZ::ComponentDescriptor::DependencyArrayType& dependent);protected:////////////////////////////////////////////////////////////////////////// AZ::Component interface implementationvoid Init() override;void Activate() override;void Deactivate() override;////////////////////////////////////////////////////////////////////////};}Source:#include "StdAfx.h"#include <AzCore/Serialization/SerializeContext.h>#include <AzCore/Serialization/EditContext.h>#include "ExampleSystemComponent.h"namespace Example{void ExampleSystemComponent::Reflect(AZ::ReflectContext* context){if (AZ::SerializeContext* serialize = azrtti_cast<AZ::SerializeContext*>(context)){serialize-ExampleSystemComponent::ReflectAZ::Component>()->Version(0)->SerializerForEmptyClass();//use the serialize context to save/load data that the component uses.if (AZ::EditContext* ec = serialize->GetEditContext()){ec-ExampleSystemComponent::Reflect("ExampleGem", Example System Component.")->ClassElement(AZ::Edit::ClassElements::EditorData, "")// ->Attribute(AZ::Edit::Attributes::Category, "") Set a category->Attribute(AZ::Edit::Attributes::AppearsInAddComponentMenu, AZ_CRC("System"))->Attribute(AZ::Edit::Attributes::AutoExpand, true);//use the edit context to add in editor interfaces.}AZ::BehaviorContext* behaviorContext = azrtti_cast<AZ::BehaviorContext*>(context);if (behaviorContext) {//Add in behavior context based stuff here.//Behavior contextes allow for lua and visual scripting interfaces.}}}void ExampleSystemComponent::GetProvidedServices(AZ::ComponentDescriptor::DependencyArrayType& provided){provided.push_back(AZ_CRC("ExampleService"));//add in what services the component provides}void ExampleSystemComponent::GetIncompatibleServices(AZ::ComponentDescriptor::DependencyArrayType& incompatible){incompatible.push_back(AZ_CRC("ExampleService"));//add in what services are incompatable with the component}void ExampleSystemComponent::GetRequiredServices(AZ::ComponentDescriptor::DependencyArrayType& required){(void)required;//add in what services are required by the component}void ExampleSystemComponent::GetDependentServices(AZ::ComponentDescriptor::DependencyArrayType& dependent){(void)dependent;//add in what services are dependent on the services}void ExampleSystemComponent::Init(){//initialize data here}void ExampleSystemComponent::Activate(){//Connect to EBuses here.//functions the same as a lua scripts "Activate" function.}void ExampleSystemComponent::Deactivate(){//Disconnect from EBuses here.//functions the same as a lua scripts "Deactivate" function.}}Components are like the lua scripts you would use but are more in depth than what you can do with a lua script.SharerePost-User-8564951answered 6 years ago0You can use either.To create a gem, you use the project configurator.When you have selected a project, there should be "Enable Gems" on the left of the project.All gems are shared between all projects. They are not used unless they are enabled for the project.From here, there's a button that says "Create a new Gem". That is where you will create a gem.Like the person above, they are in the Gems folder with the name you have given them.Be sure to enable it for the project so that you can see it in visual studio under the "Gems" sub directory in the solution explorer when you run "lmbr_waf configure".The flow for components and entities is like this:-Beginning of Entity lifespan (entity creation)-Attach component to entity-Entity Initialized (Entity::Init())-each component in the entity are initialized (Component::Init())-Entity is Activated (Entity::Activate())-each component in the entity are activated (Component::Activate())--this is where the lua's Activate function is called--this is where most if not all ebuses are connected-Entity is Deactivated (Entity::Deactivate())-each component in the entity are deactivated (Component::Deactivate())--this is where the lua's Deactivate function is called--this is where most if not all ebuses are disconnected-End of entity lifespan (entity destruction)<br>As to create a component, you can copy the system component and modify it to how you'd like with adding it's descriptor to the gem module. To make it show up in the editor, change the AZ_CRC("System") to AZ_CRC("Game") in the Reflect method's editor context. This is important.Sorry if this is hard to follow, more used to showing how it works than typing it out.SharerePost-User-8564951answered 6 years ago0The answer in https://forums.awsgametech.com/t/adding-a-component-and-enable-it-for-the-editor-bar/1171/1 is still valid. You mix up folders as dev/component never existed.Also see my answer in the post from the 12th January as I updated the answer to changes in the engine.SharerePost-User-5460328answered 6 years ago0@OneOfManyCoders Thanks!!, yes now I see it more clearly. What i want to do is create a Component not a System Component reading more the documentation i saw the difference and with this I can complete what i'm learning: With blind steps I´m trying to make a simple component with no success, the first answer just confused me more because I didn't know what I was asking for. I don't know the workflow of this, the gems are created, where?, is in VS? in the Project Configurator? Where do you know all this things? Is there a diagram of how the Gems work and the supposed Gem workflow goes? I don't know if in the documentation any of this questions are documented. I'm so frustrated with this Engine but seems to good to left it behind because of ignorance.Could you explain me how you make a Component to attach in a Entity? additionally, do you use the Lua Scripts for that behavior or you make a C++ component? For what I was reading in the doc, the Component Entity is the future of LY leaving behind the Object Entity so seems they want to use the Lua Scripting as the base of component creation, what you think?SharerePost-User-9597235answered 6 years ago"


Question: Spring Boot app cannot run DDL commands on  AWS Postgres 12.5 instance

"Application is working well on my laptop. However, when switching connecting AWS RDS (PostGres 12.5) instance getting   error : org.hibernate.tool.schema.spi.CommandAcceptanceException: Error executing DDL "Normally I would expect this would run without issues on an empty database as long as the user all permissions.Edited by: MadhuA on Mar 7, 2021 3:19 AMEdited by: MadhuA on Mar 7, 2021 3:22 AMFollowComment"

Answer: 0The issue was not having the default schema already created.CommentShareMadhuAanswered 2 years ago


Question: Looking for help logging into Graphana using JumpCloud SSO

I’m trying to hook up AWS Graphana SSO to JumpCloud using SAML2.  I’ve tried a couple of things but I’m getting a relay state error:{"message":"corresponding relay state is not found: "}Does anyone have any tips on getting this working?IdP Entity ID: JumpCloudSP Entity ID: https://g-xxxxxxxxxx.grafana-workspace.us-east-1.amazonaws.com/saml/metadataACS URL: https://g-xxxxxxxxxxxx.grafana-workspace.us-east-1.amazonaws.com/saml/acsSAML Subject NameID: emailSign Assertion: checkedDefault RelayState: blankLogin URL: blankIDP URL: https://sso.jumpcloud.com/saml2/graphanaFollowComment

Answer: "1Hi,Thank you for reaching out to us! I understand that you are facing this error message "{"message":"corresponding relay state is not found: "}" while trying to authenticate into Amazon Managed Grafana using JumpCloud SSO. Please correct me if I misunderstood your use case.From the error message, it seems that the RelayState parameter is not set."RelayState is an optional parameter that identifies a specified destination URL your users will access after signing in with SSO."https://aws.amazon.com/blogs/security/how-to-use-saml-to-automatically-direct-federated-users-to-a-specific-aws-management-console-page/The above document walks through creating a deep link for federated users via the SAML 2.0 RelayState parameter in Active Directory Federation Services (AD FS). I do understand that you aren't using AD FS as your IdP, however I wanted to provide you an example use case for it.I was able to find the following 3rd party documentation from JumpCloud that explains how you are able to set the Default RelayState parameter:"Default RelayState - Enter a value that designates the default location to which your users will be redirected after single sign-on is complete. It will be sent by JumpCloud as the RelayState either in IdP-initiated SSO or if no RelayState is received from the service provider during SP-initiated flow. The service provider may supply you with this value and refer to it as the Target URL, RelayState, or Target."https://support.jumpcloud.com/support/s/article/SSO-Application-Connector-FieldsPlease note that since this is a 3rd party documentation, I cannot comment on its validity. However, you may reach out to JumpCloud support team for any related questions or concerns.I was also able to confirm with Amazon Managed Grafana (AMG)  team that AMG supports IdP-initiated authentication and the external identity providers that have been mentioned in the following documentation have been tested with Amazon Managed Grafana.https://docs.aws.amazon.com/grafana/latest/userguide/authentication-in-AMG-SAML.html#authentication-in-AMG-SAML-providersThe AMG team mentioned that you may configure the 'Grafana workspace url' as the redirection URL for the RelayState parameter. They also mentioned that there isn't a way to set this parameter in Grafana. Therefore, I would recommend reaching out to JumpCloud support team for assistance in setting this parameter.However, if you did have any further questions for us, could you please reach out to us via a support case so we can discuss in detail?Note: All questions and answers posted to re:Post are public. You should open a support case if your question involves sensitive information.Please feel free to reach back with any further questions or concerns!CommentShareSUPPORT ENGINEERSumukhi_Panswered a year ago0I know this response is old but I'm getting the same error when integrating through Okta. Sumukhi response seems to indicate that managed grafana does support IdP-initiated requests but the documentation says it doesn't. So just want to clarify if it does.For my case, I'm getting {"message":"corresponding relay state is not found: "} when clicking on the okta tile, but logging in from grafana itself works.CommentSharefzanswered 3 days ago"


Question: Why Windows based EC2 instance goes into 1/2 status check mode

I have a runnung windows based web server and it goes into 1/2 status check mode & show Instance reachability check failed.Why these happen when server is up runningCan any provide support for itFollowComment

Answer: "0Troubleshooting instructions can be found in the following documents.https://repost.aws/knowledge-center/ec2-linux-status-check-failureIn my experience, there have been cases where the EBS volume capacity has been exhausted and the volume has been failed.CommentShareEXPERTRiku_Kobayashianswered 17 days agoGary Mclean 16 days agoTo add to this memory exhaustion is another reason this happens.Share"


Question: Is OpsWorks Stacks a dead product?

"OpsWorks Stacks is still on Chef 12, and doesn't support Ubuntu 20.04.  Today it was just outright broken for a few hours (any instance launches would fail).  Is this product still being maintained?FollowCommentQuentinD-Capsens a year ago+1 I m waiting for an answer for months now. I would add that it's not possible to launch recent instances types like r6, c6 families or all graviton instances that is really annoying for usShare"

Answer: "1For those waiting for an update, I think it's worth looking at this article: https://aws.amazon.com/blogs/mt/migrate-your-aws-opsworks-stacks-to-aws-systems-manager/ and inferring what that means for the life of Stacks.CommentShareAlexj12answered 4 months ago0Hi bscheld, thank you for sharing your concern. Supporting  new OS and Chef versions is in our current timeline.  if you want to have more updates regarding OpsWorks stacks, please feel free to contact me privately.CommentShareDorra Mlouhianswered a year agorePost-User-1857666 a year agoI'm also interested in your answer. Our web application is completely dependent on AWS OpsWorks. It is important for us to know if there is an OpsWorks end-of-life.Share0And another re:Invent passes with total radio silence on the Opsworks front. Sigh.CommentSharejlukeranswered 6 months ago0Any update on Opsworks support for ubuntu 20.04?  Ubuntu 18.04 is standard support is expiring in 3 months ( April, 2022 ).CommentShareadinarayanaanswered 4 months ago"


Question: [REQ HELP] Impaired volume on EC2 instance

"I have an EC2 on demand instance (i-0ee5714681de8a73d) which became unresponsive and cut me out from SSH access.I tried restarting, stopping & starting but it's stuck on pending status, and it shows an alert saying that the EBS volume (vol-0c70b95bfc2a99080) is impaired.I managed to stop the instance with AWS CLI, however every attempt to restart it ends with the above outcome.When the instance is stopped, I cannot even take a snapshot of the volume, which fails without giving a meaningful error, just a generic:API error messageAn internal error has occurredAccording to the EC2 dashboard, however the volume status is OKCan you help me?Kind regards,GPFollowComment"

Answer: "0We are facing the same issue today. I suppose it's global amazon problem for eu-west-2 Region:`Instance ConnectivityWe are experiencing instance connectivity issues in a single Availability Zone (euw2-az3) in the EU-WEST-2 Region.We're continuing to address connectivity issues to impacted instances in a single Availability Zone (euw2-az3) in the EU-WEST-2 Region. Services that use EC2 and EBS including Elastic Load Balancing, EFS, Elasticache, ECS Fargate, Sagemaker and ELB, are also impacted.We're continuing to address connectivity issues to impacted instances in a single Availability Zone (euw2-az3) in the EU-WEST-2 Region. We are experiencing elevated error rates for new instance launches in the impacted Availability Zone. Services that use EC2 and EBS including Connect, EFS, Elasticache, ECS Fargate, Managed Streaming for Apache Kafka and Sagemaker are also impacted.We're continuing to address connectivity issues to impacted instances in a single Availability Zone (euw2-az3) in the EU-WEST-2 Region. We are starting to see recovery for new instance launches in the impacted Availability Zone. Services that use EC2 and EBS including EFS, Elasticache, ECS Fargate, Managed Streaming for Kafka, EMR and Sagemaker are also impacted. Between 3:02 AM and 5:20 AM PST, Amazon Connect customers experienced degraded call and Chat connectivity and handling for agents in the EU-WEST-2 Region. Amazon Connect issues have been resolved and the service is operating normally.`Edited by: nislupko on Feb 1, 2021 7:37 AMCommentSharenislupkoanswered 2 years ago0@nislupkoIt seems that was the issue.Thanks for your answer!GPCommentSharegianpaolomanswered 2 years ago"


Question: How to write SimpleGraphQLRequest for listPost?

"I saw amplify documentation there a sample to get a single post like this:private GraphQLRequest<Todo> getTodoRequest(String id) {    String document = "query getTodo($id: ID!) { "        + "getTodo(id: $id) { "            + "id "            + "name "        + "}"    + "}";    return new SimpleGraphQLRequest<>(            document,            Collections.singletonMap("id", id),            Todo.class,            new GsonVariablesSerializer());}How to write the same code for list post?FollowComment"


Question: ElasticSearch Container failed to start - ECS deployment using docker compose up - /usr/share/elasticsearch/data/nodes/ AccessDeinedException

"HiI'm trying to start an elasticsearch container via - docker compose (aws-cli and switching to ecs context), but it  fails to start - AccessDeinedExcception -  cant write to /usr/share/elasticsearch/data/nodes/ directory. I have researched the issue on google and its because of the permission on that folder - from my understanding I need to fix the permissions in the host directory mapped to  /usr/share/elasticsearch/data/nodes/ (I think)runningsudo chown -R 1000:1000 [directory}However my container shuts down and how am I supposed to update the permission on that directory?this is my docker-compose - any help appreciatedversion: '3.8'services:elasticsearch01:user: $USERimage: docker.elastic.co/elasticsearch/elasticsearch:7.14.1#image: 645694603269.dkr.ecr.eu-west-2.amazonaws.com/smpn_ecr:latestcontainer_name: es02restart: unless-stoppedenvironment:cluster.name: docker-es-clusterdiscovery.type: single-nodebootstrap.memory_lock: "true"# ES_JAVA_OPTS: "-Xms2g -Xmx2g"xpack.security.enabled: "false"xpack.monitoring.enabled: "false"xpack.watcher.enabled: "false"node.name: es01network.host: 0.0.0.0logger.level: DEBUGulimits:memlock:soft: -1hard: -1volumes:- es_data01:/usr/share/elasticsearch/data:rwports:- "9200:9200"- "9300:9300"healthcheck:test: "curl -f http://localhost:9200 || exit 1"networks:- smpn_networkvolumes:es_data01:driver: localnetworks:smpn_network:driver: bridgeFollowComment"

Answer: "0When I set the uid: 0 and gid: 0 permissions on the EFS access points, it worked correctly.In docker-compose, specify volumes.es_data01.driver_opts.uid and volumes.es_data01.driver_opts.gid.version: '3.8'services:  elasticsearch01:    # user: $USER    image: docker.elastic.co/elasticsearch/elasticsearch:7.14.1    # image: 645694603269.dkr.ecr.eu-west-2.amazonaws.com/smpn_ecr:latest    container_name: es02    restart: unless-stopped    environment:      cluster.name: docker-es-cluster      discovery.type: single-node      bootstrap.memory_lock: "true"      ES_JAVA_OPTS: "-Xms2g -Xmx2g"      xpack.security.enabled: "false"      xpack.monitoring.enabled: "false"      xpack.watcher.enabled: "false"      node.name: es01      network.host: 0.0.0.0      logger.level: DEBUG    ulimits:      memlock:        soft: -1        hard: -1    volumes:      - es_data01:/usr/share/elasticsearch/data:rw    ports:      - "9200:9200"      - "9300:9300"    healthcheck:      test: "curl -f http://localhost:9200 || exit 1"    networks:      - smpn_network    deploy:      resources:        limits:          cpus: '2.0'          memory: 2048Mvolumes:  es_data01:    driver: local    driver_opts:      uid: 0      gid: 0networks:  smpn_network:    driver: bridgeReferencehttps://docs.docker.com/cloud/ecs-compose-features/#persistent-volumeshttps://docs.aws.amazon.com/efs/latest/ug/efs-access-points.htmlCommentSharemoritalousanswered a year ago"


Question: Automating PHD Notifications

"A customer is trying to automate the PHD notifications using Health API. Here is a scenario they are trying to achieve.Create a CW Event Rule for a Schedule Notification for all the Services.They are able to do it for an individual service (EC2, RDS, DX etc) but not for all services as the Dropdown only allows to select one service. I advised them that they could use Custom Event pattern option instead of going for dropdown approach to do something like this. But they are asking if there is a way to test it. Is there a way to add dummy PHD notifications for test? If not, Is there a way we could solve this use case for the customer?Here is the custom event pattern I suggested:'{  "source": ["aws.health"  ],  "detail-type": [    "AWS Health Event"  ],  "detail": {    "eventTypeCategory": [      "scheduledChange"    ]  }}'FollowComment"

Answer: "0Accepted AnswerYou are right, you can use the DescribeEventTypes API to get detailed event types if you would like to apply a filter.Done something similar with a customer though they decided to forward all AWS Health events to a central bus (and notifications from there) to make sure nothing gets "lost" and not having to maintain it execept for filtering out.CommentShareEXPERTRaphaelanswered 3 years ago"


Question: When to update apache 2.4.52 on amazon linux ?

"Currently the latest Apache version is 2.4.52 (there has been 2 security vulnerabilities fixed CVE-2021-44224 and CVE-2021-44790) and yet the latest available version is 2.4.51. Therefore I wanted to ask:Is there any estimate on when the latest Apache version will be available for installation on Amazon Linux 2 default repo?How can we install the latest Apache version on Amazon Linux 2, so that we don't have to wait for the Amazon Linux 2 team to make the latest version available? Obviously we don't want to install it from source, as we want to still manage it using yum package manager.FollowComment"

Answer: "0For questions or concerns about security in Amazon Linux or any AWS service, please reach out to our security contact: aws-security@amazon.comCommentShareEXPERTMichael_Fanswered a year ago"


Question: Sending to validated emails - causes high bounce rates with SES

"Hi guys!I have a problem:I'm using own validated (remote smtp email user checked) + surely confirmed clean (all bouncing addresses were removed just a week ago, we were sending with own server)Yesterday I've tried to send msg to the list with SES and got over 15% bounces, which is cannot be, because today I've sent mail to same addresses from my own server and got only 0.2% of bounces.Is there a chance that SES delivery servers just being rejected by recipients?PS: Please do not suggest double check my list, it is ok, I've over 6 mln addresses and deliver 300-400k daily with own servers - I wanted to use SES only for lists already confirmed ok and deliverable.ThanksAlexhttps://mediumaxis.comPS: I can see now, yahoo, aol, yandex.com reject all mails from SES......cleaned list up and will try againEdited by: lowtechthai on Mar 29, 2020 4:02 AMFollowComment"

Answer: 0Did you tried using dedicated IP instead of SES default IP ?CommentSharesunco007answered 3 years ago


Question: AWS Certified Cloud Practitioner Exam - Unable to Press EndTest Button PSI

"Hi All ,I have a query in regards with the online proctored exam for AWS certified cloud practitioner. I appeared for the exam today -Apr 08, 2021 at 5PM India time. I answered all the 65 questions and reviewed all My answers because I had some 25 minutes left before the scheduled close time. After reviewing I pinged the proctor to inform him that I was done with exam and do I need to press End Test button. He dint read My chat message properly and replied back saying I'm marking your exam as completed and before I could press EndTest button he closed the PSI Secure Browser. I was unable to view anything on the screen after that. I don't know if My answers were recorded or not. I called up the AWS certification contact numbers 18003671565  - Ext 7040 ,  and they told Me that all My answers were recorded. I haven't received any email confirmation after completion of the exam. My AWS certification account dashboard shows that Test Schedule Completed. I dont know if I have cleared the exam or not. Any suggestions on this would be really helpful.My Details :Exam : AWS Certified Cloud PractitionerExam date : Apr 08, 2021EXAM TIME: 05:00 PMTIME ZONE: Asia/KolkataCandidate ID: AWS01765077CONFIRMATION NUMBER: S76013683Thanx and RegardsShrikant PFollowComment"

Answer: "0ShrikantPa,I can confirm that your answers were recorded. Your results will appear in your Certification Portal within 5 calendar days. If you do not see them in your account within the timeframe, please submit a support ticket at https://aws.amazon.com/contact-us/aws-training/ and we will investigate.KimAWS CertificationCommentShareKimWD-AWSanswered 2 years ago0Hi Kim ,thanx for your quick response. I received My  Amazon Web Services Training and Certification badge today.Appreciate your help.Thanx & RegardsShrikantCommentShareShrikantPaanswered 2 years ago"


Question: Code pipeline - automate testing - postman/newman

"Hi ,I have spring boot application , deployed on AWS Fargate and then automate test is being run. So the source provider is GITHUB and its stored as source artifacts in S3 as zipped folder.I have integrated POSTMAN/NEWMAN in Code pipeline for test automation using Test stage and Code build.The calls are success and report has been generated but as we all know , the report is put inside the ZIP file which is not accessible using S3 url.Could you please adviseI know we can't skip the zipping by code pipeline but is there way to unzip the file(which has random names)Whats the best approach if this is not correct approach please ?Thanks,VelFollowComment"

Answer: 0Accepted AnswerI think the S3 deploy action will suit this purpose.It's documented in this page: https://docs.aws.amazon.com/codepipeline/latest/userguide/reference-pipeline-structure.htmlAnd here's a tutorial: https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-s3deploy.htmlYou probably want to set the Extract option to unzip the artifact.Let me know if this works! :)MatthewAWS CodePipeline teamCommentShareAWS-User-3346008answered 3 years ago0Thanks.. that worked like a charm :)CommentShareVelmuruganmpanswered 3 years ago0great :DCommentShareAWS-User-3346008answered 3 years ago


Question: QoS for Hosted VIFs

"I have a customer who will have a primary account to host redundant DX connections and utilize hosted VIFs for child accounts. Because the aggregate bandwidth is shared across all VIFs (Dev, Prod, ProgramA, ProgramB), the customer would like to implement some sort of QoS on the VIFs so the programs don't have to worry about their 'noisy neighbors.'From previous posts, i know that customers can utilize the APN to purchase sub 1G connections. I also know that customers need to implement the QoS on their side and avoid utilizing protocols that require configuration on both sides of a duplex link (DiffServ).......but I'm looking to provide more prescriptive guidance.Is the easiest way for customer to get QoS per-VIF on their side of the connection by using VLAN-based QoS? Something like what is described by Cisco here: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/qos/521_n1_1/b_5k_QoS_Config_521N11/b_5k_QoS_Config_521N11_chapter_01000.pdfAmy I missing anything? Any other ways to do this?FollowComment"

Answer: "0Accepted AnswerThe link you've shared is focusing on Layer 2 QoS which wouldn't be applicable here.If they want to rate limit traffic per VLAN they need to apply traffic policing on each Layer 3 VLAN interface on their end i.e. VLAN x gets 30Mbps inbound and outbound, VLAN Y gets 50 Mbps inbound and outbound etc.The configuration will depend on the vendor and software they're using but here are a couple of Cisco examples:https://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpoli.htmlhttps://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_plcshp/configuration/xe-3s/qos-plcshp-xe-3s-book/qos-plcshp-class-plc.htmlBare in mind traffic policing is only a subset of what real QoS actually is but in this case it's all that is available.CommentShareEXPERTAWS-User-7100868answered 5 years ago"


Question: Mutli-site Active/Active Disaster Recovery (DR) Architecture on AWS

"Hi guys!I'm researching DR on AWS and when I read the Active/Active strategy, I see that AWS notes this strategy is zero downtime. I don't understand why this is zero downtime.For example, when customers are accessing our app in one region, when this region is down so the customers still have lost connection and then waiting for failing over to the new region. I think there is still downtime but it is very short.Could you please explain more detail about this problem?https://aws.amazon.com/blogs/architecture/disaster-recovery-dr-architecture-on-aws-part-i-strategies-for-recovery-in-the-cloud/FollowComment"

Answer: "1Accepted AnswerIt depends on the nature of the service you're providing, in particular how you're storing state and data. If the service is stateless then users can be redirected to a working region as soon as Route53 deems the failed region unhealthy. In a more realistic scenario it's likely some existing sessions might be lost or delayed since the limits of CAP will be reached, but new sessions could be served from the healthy region.CommentShareedeastwoodanswered 10 months ago0We are talking about multi-site Active/Active solution here. That means both sites are actively writing and syncing. If local copy fails, it's not about failing over for the DB but it just need a single retry from application side to read/write the data. We refer to this type of availability as continuous availability, to distinguish it from the high availability where there is brief downtime during failover.Ideally there is no failover here as second copy in other region is active and up-to-date.e.g https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-multi-master.htmlCommentShareAWS-User-1545586answered 5 months ago"


Question: Managed Grafana - Add Images to Dashboard

"According to the Grafana docs as well as the Grafana docs, you should be able to embed images into a dashboard using either a Text widget or as a value in a table.  I have tried every possible way, HTML, base64, direct link to the image, text addon, table view... Every attempt results in a broken image icon rather than the image.https://docs.aws.amazon.com/grafana/latest/userguide/table-panel.htmlhttps://community.grafana.com/t/using-text-panel-to-show-image-where-to-store-image/6642I've read that there's an INI setting that you may need to change, but Amazon does not give us that level of access.Has anyone figured this out?FollowComment"

Answer: "2This is possible. In the panel text entry, try adding this with HTML selected:<img src="data:image/png;base64, iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg=="/>This is an example which displays a red dot. You will need to convert a PNG image into a Base64 encoded image. Use this:https://www.opinionatedgeek.com/Codecs/Base64EncoderAdd you own Base64 encoded image. I don't know the size limitation for the text panel, but I managed a 126x80 PNG of a logo.CommentShareAWS-User-0379651answered a year agoJasonH 10 months agoClever workaround here.Native Grafana allows an image src in a HTML text box, AWS managed Grafana doesn't appear to allow image src, which is not good !I have used this service https://www.base64-image.de/ and managed to get 509kb png into AWS managed grafana using this technique to paste the base64 encoded text into the img src tag.However... take a look at the JSON behind the scenes!Share0I am also blocked on this. A client requires branding be added to the AMG dashboard. I can embedded an image sourced from an S3 bucket using a non-managed version of Grafana. If I add the same object URL to a text panel (having selected HTML) I only ever see a broken image icon.This is a really useful and important feature to allow branding of a dashboard. Please can you indicate if this will ever be supported or if it is supported and how I may solve the problem? Thank you in advance for any help you can offer.CommentShareAWS-User-0379651answered a year ago"


Question: S3 Dataset versioning with SageMaker?

"Is there any standard for ML S3 dataset tracking or versioning?Basically, what setup allows to track a given model training execution to a given dataset?Interested to hear about proven or state-of-the-art ideasFollowComment"

Answer: "1Nowadays, there are 3rd party tool that can be used alongside SageMaker. One example is Data Version Control (DVC), and we have discussed it how to integrate within SageMaker Processing jobs and SageMaker Training Jobs in this blogpost.As an alternative, you can leverage SageMaker Pipelines when your data preparation step is executed as a processing step within a pipeline execution. Pipelines allows you to achieve data versioning in a programmatic way by using execution-specific variables like ExecutionVariables.PIPELINE_EXECUTION_ID, which is the unique ID of a pipeline run. We can, for example, create a unique key for storing the output datasets in S3 that ties them to a specific pipeline run. We have also discussed this possibility as part of this blogpost.CommentSharePaolo_DFanswered 8 months ago0Accepted AnswerUnfortunately, managing versions of datasets and which models used them is not embedded in SageMaker. But, you can use SageMaker search to manage the differences in data location between experiments. In that case, if your dataset isn't too big, my recommendation will be to create a standard for data structure in S3. i.e. for each new dataset, create a new prefix in S3 with your logic.Using SageMaker search you'll be able to find all your jobs and compare between datasets.CommentShareAWS-User-7953554answered 4 years ago"


Question: Power brick for Elemental Live L013AE?

Misplaced power brick for an older small form factor elemental appliance. I know it needs 12v DC but not sure of the amperage or jack size. Where can I grab a replacement?FollowComment

Answer: "1Accepted AnswerHi Weston,I hope you're having a good day. I spoke with our Ops team and it appears the power supply is 12v and 12.5A that provides 150W DC to the unit.The part number is MCP-250-10128-0N for L013AE. Using the part number, I was able to find the correct replacement. If you would prefer to place the order directly through Elemental Technologies, I would advise you to get in contact with your technical account manager, or create a formal support ticket as mentioned by Vineet.-AdrianCommentShareAdriananswered 8 months agoweston_33 8 months agoThank you Adrian!Share1Hi @weston_33,Please create a support ticket in "elemental-appliances-software" in AWS console, and provide the corresponding serial number to follow up this case.Serial number could be found by:Running command below via ssh sessionsudo dmidecode --type 1 | egrep "Serial|Version"The serial number is the 15-digit string without dash that usually starts with an "S" or "C". Take a picture of all of the stickers on the appliance (make sure the numbers are clearly visible) so we can help to narrow down the serial number.Please feel free to reach out for further queries on this. Thank you.Regards, VineetCommentShareSUPPORT ENGINEERVineet_Ranswered 8 months ago"


Question: Site to Site VPN with Private and Public - Mikrotik

I've set up the tunnels exactly as per the instructions (although their instructions for the Mikrotik are out of date).Both tunnels are up.   I can ping the other side of each tunnel's interior 169 IP Address.I spin up an EC2 instance in a private network on a /24.  Lets use 10.55.0.2/24.   I create a security group allowing SSH and ICMP from 0.0.0.0/0.  It does not have a public ip.I make sure my side (Mikrotik) has the route to that 10.55.0.0/24 via the other end tunnel ip address.   So from my Mikrotik router I should be able to ping from my exterior ip address.  It does not ping.I don't have NAT on that IP address at the Mikrotik so no firewall rules necessary.  However just to rule that out I set up a rule to accept input from ipsec/ike from the other side.Static routes on the Site to Site on the AWS side for the Virtual Private Gateway are all the subnets on the Mikrotik side that would be contacting it.It just seems that from the interior AWS 169.x.x.x ip address to the EC2 instance can't communicate or will not route back through the tunnel.Desperate for help on this one.  I know I've followed all of the instructions to the letter and have tried multiple approaches without luck.FollowComment

Answer: 0Figured it out on my end.CommentShareSteveKenneyanswered 2 years ago


Question: How to use Low-Latency HLS with MediaPackage?

"I want to build a solution for live and on-demand video streaming. My custom service will receive RTMP streams, produce HLS and dump it to S3/stream it directly to MediaPackage.To make the latency lower, I want my custom service to output Low-Latency HLS (community, not the Apple one). I want to achieve it by using segments with ~2s duration and EXT-X-PREFETCH tag.Will MediaPackage be able to process this?If so, will the HLS outputted by MediaPackage also be "low-latency"?Can I use MediaPackage to produce Low-Latency HLS for me (instead of implementing this in my custom service)?FollowComment"

Answer: "0Additional information is required to understand what type of HLS Low Latency is being implemented. The reference to 'community, not the Apple one' does not provide details on what features are desired to achieve LL.AWS MediaPackage does not currently support the Apple HLS-LL requirements.Though 2sec segments can be used with MediaPackage, the The EXT-X-PREFETCH tag contained in HLS manifests will not trigger any function to provide partial segment data.Full system latency is dependent on encoding time, origin processing (MediaPackage) and CDN delivery. Any HLS LL delivery would require all components to support the mechanism being used.CommentShareMike-MEanswered a year ago"


Question: How to remove a component from running on an installation

"I have created a deployment which deploys a component to a Thing Group, which contains Thing-X - and this results in the successfull deploymnet and running of the component on Thing-X. However, when I remove Thing-X from the Thing Group being targetted by the deployment - it doesn't seem to remove the component from being run on Thing-X. Also - i'm pretty sure when i revised the original deployment to the thing group, without Thing-X, it still doesn't remove the component from being run.Currently, the device's IoT policy currently grant's all permissions on greengrass:*What is the correct process to remove a component from being run after it's been deployed ?FollowComment"

Answer: "0Accepted AnswerHi majh. If you haven't already, please read this document: https://docs.aws.amazon.com/greengrass/v2/developerguide/manage-deployments.html. In particular:What version of the nucleus are you running?If you are running 2.5.1 or later, and the greengrass:ListThingGroupsForCoreDevice permission is granted in the policy (and it seems to be in your case), then the component would be removed on "the next deployment" to that device.  (So long as another deployment that targets the device doesn't include that component.)CommentShareEXPERTGreg_Banswered 9 months agomajh 9 months agoThanks @Greg_B - So  what does this boil down to operationally  - as it seems like we want to redeploy to that unit, but not actually change anything, just trigger the process which will remove the component.Is there any sort of generally used scheme for this ?Do we just revise a deployment that is targetting that particular 'Thing' and that will be the trigger ? Or do we need some sort of dummy 'Trigger' component that is just sent down to allow cleanup of removed components ?ShareJoeAtAWS 9 months agoHi majh - I'm not sure I understand your statement. Removing a component certainly changes the state of the device. Are you not adding Thing-X to a different group which would trigger a deployment? If not, then you'll need a deployment that targets the Thing.Sharemajh 9 months agoHi JoeAtAWS - In this case - I didn't have a specific need to add Thing-X to a different group, what I wanted, was just to remove the component from being run on the thing. So basically what I meant was, it seems to me that in order to actually have the component removed from the Thing-X, I have to first remove the thing from the group targeted by the component deployment, and then create some sort of dummy or trigger deployment to send down to that thing - so that the removal actually happens. And i was asking how  this is generally done. It just seems like there should be a dummy trigger component that's only purpose is to be sent down to the unit to force any component removals to occcur.Share"