Question: Update one and just one document in DynamoDB

"I'm creating a Call Center system and I would like to know how to update one and just one document in a DynamoDB table in order to avoid making duplicated calls, let's say I will load a pool of numbers available to call and I need to mark them when an agent take one of the phonenumbers.FollowComment"

Answer: "3For me, I would perhaps use a secondary index for this. Lets imagine each of the items in the pool are a separate item and your table looks like this:CallNoDateOtherisTakenUser12342022-09-01T00:00DataNo98762022-09-02T16:00DataJeff56782022-09-01T10:00DataNo45672022-09-01T12:00DataLeeNo, each of the available calls have the attribute isTaken with a value of "No". So then we have a Global Secondary Index which is sparse in nature, and we decide the partition key for that is the isTaken column while the sort key is Date, in which only items from the table with a value for isTaken will be stored in the index, ordered by the date:isTakenDateCallNoOtherNo2022-09-01T00:001234DataNo2022-09-01T10:005678DataSo now you can see the only items in the index are the calls which are in the Available queue. So when an operator wishes to retrieve an available call, they do a Query operation on the index defining a partition key of No and a Limit=1, in which they will retrieve the oldest item in the waiting queue:aws dynamodb query \--table-name test1 \--index-name available \--key-condition-expression "isTaken = :val" \--expression-attribute-values  '{":val":{"S":"No"}}' \--limit 1isTakenDateCallNoOtherNo2022-09-01T00:001234DataOnce an operator receives their item, they must lock it to themselves by adding their User name to it and removing the isTaken value to remove it from the available queue:aws dynamodb update-item \--table-name test1 \--key '{"CallNo": {"N": "1234"}}' \--update-expression "SET #attr_one = :attr_val REMOVE #attr_two " \--expression-attribute-names '{"#attr_one":"User", "#attr_two: "isTaken"}' \--expression-attribute-values '{":attr_one":{"S": "Lee"}}' \--condition-expression "attribute_exists(#attr_two)"The update will remove the item from the GSI by removing the value for isTaken, it uses a condition expression only to update that item if isTaken already exists, if it evaluates to false, the update will fail which means another user has already taken that call and you have to poll the available queue for the next available call.After this, your table will look like below:CallNoDateOtherisTakenUser12342022-09-01T00:00DataLee98762022-09-02T16:00DataJeff56782022-09-01T10:00DataNo45672022-09-01T12:00DataLeeAnd the Available index:isTakenDateCallNoOtherNo2022-09-01T10:005678DataCommentShareEXPERTLeeroy Hannigananswered 9 months agoArmand 9 months agoThanks Leeroy, sounds very good!ShareLeeroy Hannigan EXPERT9 months agoYou're welcome Armand, please feel free to accept the answer should it satisfy your use-case.Share2Hello - You can update (or perform general CRUD operations) on a single item by following this guide.The TLDR is essentially:DynamoDB provides four operations for basic create, read, update, and delete (CRUD) functionality. All these operations are atomic.PutItem — Create an item.GetItem — Read an item.UpdateItem — Update an item.DeleteItem — Delete an item.Each of these operations requires that you specify the primary key of the item that you want to work with. For example, to read an item using GetItem, you must specify the partition key and sort key (if applicable) for that item.CommentSharePaul Frederiksenanswered 9 months agoArmand 9 months agoThanks, but being more specific: I need to update just one record by the condition status and not for the primary key. Based on this I could have several records, but I need to update only one with a code to know what agent has taken the record.Does make sense?SharePaul Frederiksen 9 months agoSo you are adding a pool of numbers into an item? You'd need to use filter expressions - https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Query.html#Query.FilterExpressionIt might make more sense for each number to be it's own item though. It would make adding and querying attributes much simpler.Share"


Question: RE: Amazon Connect - Populate contact Attributes for Dropped

"Hi,We have callflow which collect callers data from backend using Lambda.Some scenarios, Callers are dropping calls before those data are populated to Contact Attributes.How can we populate those data after DISCONNECT message is received?Thanks,SelvaFollowComment"

Answer: "1Hi Selva, I'm assuming you're currently using an "Invoke AWS Lambda function" block in your contact flow to call the Lambda, and then using "Set contact attributes" to populate the attributes from the Lambda return value. If the call disconnects during that time (eg while the Lambda is executing) the contact flow will stop running and the attributes won't be set.In this situation, you can use the UpdateContactAttributes API to populate the values. Use the contact records stream to check each completed call; if it doesn't have the attributes populated you can invoke your logic to look up the customer details and update those attributes.CommentSharelukwarneanswered 7 months agoEXPERTAWS-samfredreviewed 2 months ago"


Question: V3 JS SDK Kinesis Client getting ERR_HTTP2_INVALID_SESSION error

"Hi There, I am trying out Kinesis Client in JS SDK V3. When I create a Kinesis Client in the global scope and reuse the same client for all further Kinesis ingestion, I am noticing that after a while I am getting the following error.1|new-sig      | { Error [ERR_HTTP2_INVALID_SESSION]: The session has been destroyed1|new-sig      |     at ClientHttp2Session.request (internal/http2/core.js:1559:13)1|new-sig      |     at Promise (/home/ec2-user/signaling-v7.temasys.io/node_modules/@aws-sdk/node-http-handler/dist-cjs/node-http2-handler.js:57:33)1|new-sig      |     at new Promise (<anonymous>)1|new-sig      |     at NodeHttp2Handler.handle (/home/ec2-user/signaling-v7.temasys.io/node_modules/@aws-sdk/node-http-handler/dist-cjs/node-http2-handler.js:37:16)1|new-sig      |     at stack.resolve (/home/ec2-user/signaling-v7.temasys.io/node_modules/@aws-sdk/client-kinesis/dist-cjs/commands/PutRecordCommand.js:27:58)1|new-sig      |     at /home/ec2-user/signaling-v7.temasys.io/node_modules/@aws-sdk/middleware-serde/dist-cjs/deserializerMiddleware.js:5:321|new-sig      |     at /home/ec2-user/signaling-v7.temasys.io/node_modules/@aws-sdk/middleware-signing/dist-cjs/middleware.js:11:261|new-sig      |     at process._tickCallback (internal/process/next_tick.js:68:7) '$metadata': { attempts: 1, totalRetryDelay: 0 } }I am not getting an idea as to why this is happening. However when I use a custom requestHandler and disable Keep-Alive the client stops throwing the error (like the below code)const { NodeHttpHandler } = require("@aws-sdk/node-http-handler");const { Agent } = require("http");const kinesisClient = new KinesisClient({ region: kinesisDataStream.region,  requestHandler: new NodeHttpHandler({    httpAgent: new Agent({keepAlive: false})  })});Could you help me in understanding what's going on ? Thanks a lot.FollowComment"

Answer: "0Hi , hope this situation has been resolved by now.for the next time , or otherwise if you still have the issue. This is a case in which AWS Support should be able to help you, because no general answer may apply and something contextual to your account might be causing the issue.Your best next steps would be to open a Support case, in case you have not yet a Support subscription, consider to upgrade to Developer Support or Business support depending on the urgency of your case.Without looking at the internal logs or having more detailed information on the situation it is not possible to provide guidance, sorry.Hope this helpsCommentShareSUPPORT ENGINEERVarun_Sanswered a year ago"


Question: "I am using Lightsail server installed Bitnami WP - my site is getting not reachable , I need to reboot or stop and start instance. then its working"

"Hi, i am using wordpress from 2 years - from recently i am fashising new issuse that i need to reboot or stop and start aws server , then its working .FollowComment"

Answer: "0Hi,You may need a upgrade your instance to a larger plan for your website.  You can use the below doc to help investigate your cpu performance and determine if you need a larger plan.https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-viewing-instance-burst-capacityCommentShareVarun_Ranswered 2 months ago"


Question: [1.12.0.0] crcfix.exe has stopped working

"Hey folks,When create a new (empty) project I get the following error:REMOVEDUPLOADAny ideas?Follow"

Answer: "0Accepted AnswerUpdate to this, i unchecked the 'CryEntiyRemoval.gem' rebuilt it and its now working perfectly.Thanks for your help :)SharerePost-User-4334136answered 5 years ago0Same thing here. I'm getting incredibly frustrated with this engine, fighting the thing before it's even open is not a good sign.SharerePost-User-1573454answered 5 years ago0Literally hit every single one of those errors. Trying to build gems is also fraught with error messages.EDIT: Attempting it again and will post back here (seems like having one source for both of these problems is on-topic given they are sequential problems) when it finishes.EDIT 2: Got an Asset Processor error about gems being unbuilt WHILE building gems.REMOVEDUPLOADSharerePost-User-1573454answered 5 years ago0I am having the same issue as everyone above. How long did it take for it to build for you?EDIT Nevermind, it just finished building.SharerePost-User-6919639answered 5 years ago0@REDACTEDUSERSharerePost-User-2229564answered 5 years ago0Same here....First:REMOVEDUPLOADThen after trying to launch the project:REMOVEDUPLOADAnd:REMOVEDUPLOADSharerePost-User-4334136answered 5 years ago0@REDACTEDUSERSharerePost-User-2229564answered 5 years ago0What Command are you using to build the project? Also I don't know if this would work but have you tried going into Task Manager and ending the Asset Processor program?SharerePost-User-2229564answered 5 years ago0Just leaving it running doesn't work for me.Is there a working fix for this? :)SharerePost-User-4334136answered 5 years ago0Opening the Project Configurator as administrator has worked for meSharerePost-User-8391191answered 5 years ago0Hey folks -- I'm very sorry for this extremely frustrating experience. Let me fetch some answers on this issue in parallel to efforts @REDACTEDUSERSharerePost-User-5738838answered 5 years ago0Yeah, it worked. Thanks for your reply!SharerePost-User-6919639answered 5 years ago0Nice! Hey folks, does this help in your case as well?SharerePost-User-5738838answered 5 years ago0Thank you :)SharerePost-User-4334136answered 5 years ago0Unfortunatley not, no :(SharerePost-User-4334136answered 5 years ago0Bleh -- alrighty, thanks for trying @REDACTEDUSERSharerePost-User-5738838answered 5 years ago0@REDACTEDUSERI was dealing with this problem and got a working solution:I created my project from the console commandstopped it when it the crcfix error came up (build seemed to stop there / no new files being generated)set your new project as default (either through project config or console).note: I noticed when using the project configurator, my project folder would be deleted but not when creating through the console.lmbr_waf configureopen the solution generated from configure, and build in VSnote: this last step probably would have worked using lmbr_waf build_... but didn't test thatHope this works for some others!SharerePost-User-5509042answered 5 years ago0Hey @REDACTEDUSERSharerePost-User-8843326answered 5 years ago0@REDACTEDUSERSharerePost-User-8843326answered 5 years ago0Hey @REDACTEDUSERSharerePost-User-5738838answered 5 years ago0Sorry, I was afk this whole New Years. I did a profile build, so it was my dev/Solutions/projectName_vc140SharerePost-User-5509042answered 5 years ago0Thank you, please let us know when the fix is live :)SharerePost-User-4334136answered 5 years ago0Also doesn't work for me :(REMOVEDUPLOADSharerePost-User-4334136answered 5 years ago0I found out how to fix the CRCFix.exe error!Omg it's so simple I feel dumb :'(Simply remove Microsoft Visual c++ 2017 redistributals in add/remove programs and install the 2015 version!Run project configurator as administrator and should work but if you still have issues run in compatibility mode for win 8 if you're on win 10.NO ERRORS!Yay!<3PSI had to download the 2015 C++ redistributal from Microsoft's site. I did a google search for it. It's about 14 megabytes and did the x64 version.-Stevan2nd edit:A few other things I did they may have affected the solution:-I deleted a program called IIS in add/remove programs that apparently was installed by visual studio.-I turned off my firewall and internet until build was finished.-I play war thunder a lot so I disabled the ganjin program from running and closed steam.@REDACTEDUSERMake sure you have Visual studio 2015 or 2013 installed and not the 2017 version.Also go through list in your add/remove programs and make sure you have the corresponding c++ distributables as listed in the project configurator setup.I believe if you roll back certain versions it will help.It took me like a half hour or more to have the project finally build so be patient. If you open up task manager and expand the Lumberyard program and see the sub running processes it will show you a lot about what's going on under the hood.SharerePost-User-7719972answered 5 years ago0Also doesn't work for me.I have to say i'm getting tired of fighting with Lumberyard 1.12, 1.11 works fine but i don't want to be stuck on that forever.SharerePost-User-4334136answered 5 years ago0Also just FYI it took me about a half an hour to build the project for but I have an i5 and using just my laptop a dell precision m6800. So if your like me just be patient and let it build and I'm sure it will work :)SharerePost-User-7719972answered 5 years ago0Hey @REDACTEDUSERSharerePost-User-5738838answered 5 years ago0I don't get that warning anymore, now it completes and then craps out with the same errors.A 1 minute 40 second edited recording of what is actually happening.next i'll try unistalling and reinstalling VS2015, maybe that's become broken.https://www.youtube.com/watch?v=Q1qavm578dsSharerePost-User-4334136answered 5 years ago"


Question: Aurora postgresql major version upgrade from 9.6 to 10.18

"Seeing some errors in the Postgresql log file. But other than these reported errors, the db instance is working fine and applications have no issues connecting, reading and writing to db instance.We want some help from AWS to verify if these errors require any further action. Thanks.2021-12-07T03:29:32.000ZCopy2021-12-07 03:29:32 UTC::@:[8182]:WARNING:  unrecognized configuration parameter "rds.adaptive_autovacuum"2021-12-07 03:29:32 UTC::@:[8182]:WARNING: unrecognized configuration parameter "rds.adaptive_autovacuum"2021-12-07T03:29:32.000ZCopy2021-12-07 03:29:32 UTC::@:[8182]:WARNING:  unrecognized configuration parameter "rds.enable_plan_management"2021-12-07 03:29:32 UTC::@:[8182]:WARNING: unrecognized configuration parameter "rds.enable_plan_management"2021-12-07T03:29:32.000Z2021-12-07 03:29:32 UTC::@:[8182]:LOG: database system is shut down Postgres Shared Memory Value: 51704012800 bytes LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf"2021-12-07T03:29:35.000Z2021-12-07 03:29:35 UTC::@:[8776]:WARNING: unrecognized configuration parameter "rds.adaptive_autovacuum"2021-12-07T03:29:35.000Z2021-12-07 03:29:35 UTC::@:[8776]:WARNING: unrecognized configuration parameter "rds.enable_plan_management"2021-12-07T03:29:35.000Z2021-12-07 03:29:35 UTC::@:[8776]:LOG: redirecting log output to logging collector process2021-12-07T03:29:35.000Z2021-12-07 03:29:35 UTC::@:[8776]:HINT: Future log output will appear in directory "/rdsdbdata/log/error".2021-12-07T03:38:49.000Z2021-12-07 03:38:49 UTC::@:[8777]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf"2021-12-07T03:51:10.000Z2021-12-07 03:51:10 UTC::@:[29750]:LOG: setting shmemname /mnt/hugetlbfs/aurora-postgres-buffer-cache2021-12-07T03:51:10.000Z2021-12-07 03:51:10 UTC::@:[29743]:LOG: Waiting for runtime initialization complete...2021-12-07T03:51:11.000Z2021-12-07 03:51:11 UTC:[local]:rdsadmin@rdsadmin:[30193]:FATAL: the database system is starting up2021-12-07T03:51:11.000Z2021-12-07 03:51:11 UTC::@:[30192]:LOG: database system was interrupted; last known up at 2021-12-07 03:50:57 UTC2021-12-07T03:51:11.000Z2021-12-07 03:51:11 UTC::@:[30192]:LOG: Outbound recovery is not required2021-12-07T03:51:12.000Z2021-12-07 03:51:12 UTC:[local]:rdsadmin@rdsadmin:[30220]:FATAL: the database system is starting up2021-12-07T03:51:13.000Z2021-12-07 03:51:13 UTC::@:[29743]:LOG: database system is ready to accept connections2021-12-07T03:55:10.000Z2021-12-07 03:55:10 UTC::@:[29743]:LOG: received SIGHUP, reloading configuration files2021-12-07T03:55:10.000Z2021-12-07 03:55:10 UTC::@:[29743]:LOG: parameter "unix_socket_permissions" cannot be changed without restarting the server2021-12-07T03:55:10.000Z2021-12-07 03:55:10 UTC::@:[29743]:LOG: parameter "apg_critical_insights_enabled" changed to "on"2021-12-07T03:55:10.000Z2021-12-07 03:55:10 UTC::@:[29743]:LOG: configuration file "/rdsdbdata/config/postgresql.conf" contains errors; unaffected changes were applied2021-12-07T09:48:09.000Z2021-12-07 09:48:09 UTC:10.201.11.180(61119):postgresrds@spam:[17324]:LOG: could not receive data from client: Connection timed outFollowComment"

Answer: "0I don't see any issues. "rds.adaptive_autovacuum", "rds.enable_plan_management" are RDS specific parameters and thus came up as warnings.Just make sure to run ANALYZE on databases after major version upgrades to make sure pg_statistics has fresh stats of tables.As always, if you have any issues in upgrading RDS databases, please feel free to open up a support case.CommentShareVivek_Sanswered a year agoAWS-User-3261221 a year agoI ran the ANALYZE command. Most of the tables completed successfully except for a few:We are not quite sure as to how the superuser can be created. Please clarify. Thanks.2021-12-07T04:00:51.000Z2021-12-07 04:00:51 UTC:10.201.11.180(61119):postgresrds@spam:[17324]:WARNING: skipping "pg_database" --- only superuser can analyze it2021-12-07T04:00:51.000Z2021-12-07 04:00:51 UTC:10.201.11.180(61119):postgresrds@spam:[17324]:WARNING: skipping "pg_db_role_setting" --- only superuser can analyze it2021-12-07T04:00:51.000Z2021-12-07 04:00:51 UTC:10.201.11.180(61119):postgresrds@spam:[17324]:WARNING: skipping "pg_tablespace" --- only superuser can analyze it2021-12-07T04:00:51.000Z2021-12-07 04:00:51 UTC:10.201.11.180(61119):postgresrds@spam:[17324]:WARNING: skipping "pg_pltemplate" --- only superuser can analyze it2021-12-07T04:00:51.000Z2021-12-07 04:00:51 UTC:10.201.11.180(61119):postgresrds@spam:[17324]:WARNING: skipping "pg_auth_members" --- only superuser can analyze it2021-12-07T04:00:51.000Z2021-12-07 04:00:51 UTC:10.201.11.180(61119):postgresrds@spam:[17324]:WARNING: skipping "pg_shdepend" --- only superuser can analyze it2021-12-07T04:00:51.000Z2021-12-07 04:00:51 UTC:10.201.11.180(61119):postgresrds@spam:[17324]:WARNING: skipping "pg_shdescription" --- only superuser can analyze it2021-12-07T04:00:52.000Z2021-12-07 04:00:52 UTC:10.201.11.180(61119):postgresrds@spam:[17324]:WARNING: skipping "pg_replication_origin" --- only superuser can analyze itShare"


Question: Easy way to retrieve contacts time in queue in the desktop?

"I would like to show the agent how long a caller held in queue when it arrives. I'm hoping there's a way to get this information natively, but can't find any documentation. One option is to set an attribute when a call enters the queue, but I was hoping there would be a more elegant way.Thank you,davidFollowComment"

Answer: "1Setting a timestamp in the Contact Attribute is most likely the cleanest without using any API.  And when the call arrives, you can calculate the current timestamp minus the enqueueTS.The DescribeContact API does return EnqueueTimestamp which can be used for similar purpose but I would avoid this as it goes against the 2 API per sec limit.CommentShareClarenceChoianswered 5 months agoEXPERTAWS-samfredreviewed 2 months agodmacias 5 months agoYeah that's what I ended up doing as it seemed like the easiest. Would be nice if this information would be included as part of the call data as I can see other use cases for it. Thanks for replying.Share"


Question: unable to create cloud9 environment

"I'm not sure why this is working, but I have done everything that I have been told to check for when running new cloud9 env. I have connected it to my VPC, and picked a public subnet. My internet gateway is connected to the route table, but it's still saying there is an issue with my VPC configuration. Any help would be appreciated.FollowCommentrePost-User-3395311 7 months agoError message: "Cloud9 could not connect to the EC2 instance. Please check your VPC configuration and network settings to troubleshoot the issue"Share"

Answer: "0It is difficult to troubleshoot this without access to the environment but here is configuration information for the VPC, VPC settings for AWS Cloud9 Development Environments. I would first check to see that the security group and nacl are correct. Make sure the instance as a public IP address.There is also a QuickStart that you could use the setup the environment.CommentShareEXPERTkentradanswered 7 months ago"


Question: Trigger Step Function with API Gateway and use Fargate within Step Function?

"I want to be able to have a step function that does the following:The step function starts with a call to API Gateway from my web appThe step function starts a Fargate pod based on a specific imageThe step function runs a task on the pod it just createdAfter the Fargate task completes, terminate the pod so it does not consume resourcesIs this possible to tell Step Functions to start a new pod based on a certain image and then terminate that pod after it returns a success code?I have not been able to find any info on this.Thank youFollowComment"

Answer: "1Please do respect the time others dedicated helping you by mark answers as accepted.You can do this by -Once the task has been completed, you can query the TaskARN through the metadata service and terminate the task;You should also mark the step function step as completed;Fargate tasks never "completes" before the "pod".CommentShareJason_Sanswered a year agoAWS-User-5311484 a year ago@Jason_SThank you for that info.I understand getting the ARN and terminate the task but is it possible to have Step Functions tell Fargate to spin up a pod based on a specific image to run a task like I mentioned in step 2? I have not been able to find any info on this. All I have been able to find is to send a task to an already running pod.ThanksShare0The link below and its subordinate pages provide more detail on invoking Fargate tasks from Step Functions workflows, and how to pass all available configuration parameters for control of the "pods".https://docs.aws.amazon.com/step-functions/latest/dg/connect-ecs.htmlCommentShareAWSdaveanswered 5 months ago"


Question: EKS Worker-node join

"Hi Guys,I would like to start a standalone worker-node (with launch config, and ASG works correctly)but when I make a copy (a launch template) from my launch config (with all the parameters that works with ASG) and start an instance manually , the node never join to the cluster.I also ssh into this node and fire the bootstrap.sh with manually from the root console, but also nothing happen.where can I see log or something, I would like to figure out why I am not able to start a single worker by my hand :)Do you have any idea what is going on? what should I check?Thanks,Darvips: My Target is to run a single node connected to my cluster with specific label and fix private IP in a subnet. So I can run my app as a daemonset (it is an IoT data collector / UDP, and I need the device IP from the network - so I cannot use NLB/UDP because every packet would come from the NLB's IP and that is not good for me ;( )FollowComment"

Answer: "0I can answer my question!The problem was the cluster tags on the ec2 instancesolution is to use this:- Key: kubernetes.io/cluster/${ClusterName}Value: ownedit comes from the CF template:https://amazon-eks.s3-us-west-2.amazonaws.com/cloudformation/2019-02-11/amazon-eks-nodegroup.yamlRegards,DarviCommentShareDarvianswered 4 years ago"


Question: Lightsail Unresponsive

"I'm new to AWS. I created a new minimal Lightsail instance with Debian 11, Tomcat 9 and a static IP (3.98.42.206). It was running normally then at about 7:05AM PST today (May 22) I uploaded a .war file via SFTP. The transfer appeared to complete normally. I didn't do anything after that. Now it's unresponsive to both ssh and sftp. Metrics show CPU spiking to 100% then the graph grays out, which I am guessing means the monitoring system thinks it's down? (Status in AWS console shows "Running"). This same thing happened yesterday (it was unresponsive for hours but eventually came back on its own somehow). As far as I know this is a totally unremarkable instance with nothing special installed. Any suggestions?FollowComment"

Answer: "1As far as the information you shared, you can think that SSH etc. became impossible because the CPU was exhausted.There are many reasons for CPU exhaustion.For example, the load of the applications you are running or the capacity of the storage you are using has reached its maximum.We recommend checking your Lightsail metrics and system logs to see if anything is amiss.CommentShareEXPERTRiku_Kobayashianswered 13 days ago"


Question: How reliable is the time field in the FlexMatch event notification messages?

"I'm not sure how I didn't notice this before, but apparently each message that gets published to the SNS topic from FlexMatch has two time fields. The first one is a field called Timestamp, which is a part of the whole SNS object that is sent to the lambda function subscribed to the topic receiving gamelift events. I actually refer to this field in another question I had before here. But I didn't realize that the actual message itself inside the SNS object had a field called time. So is the Timestamp field the value of when the message arrived to the SNS topic? While the time field is the true value of when the message was created by FlexMatch? I'm asking because I'm wondering if the time field is a good way to get the correct ordering of the event notifications. This could be very useful for sorting matchmaking ticket information in a DynamoDb table. And when I mention good, I also mean safe. For example, can two events for the same matchmaking ticket/request have the exact same time field? If so, then I am not sure how those events would be differentiated order-wise in a tie-breaker scenario. Here's an example of what the event object looks like when the Lambda function that is subscribed to the topic is invoked,   "Records": [        {            "EventSource": "aws:sns",            "EventVersion": "1.0",            "EventSubscriptionArn": "...",            "Sns": {                ...                "Message": "{...}",                "Timestamp": "2020-05-01T00:45:41.363Z",                ...            }        }    ]And that message object in that SNS object could look like this for example,{    "version": "0",    "id": "...",    "detail-type": "GameLift Matchmaking Event",    "source": "aws.gamelift",    "account": "...",    "time": "2020-05-01T00:45:41.355Z",    "region": "...",    "resources": [        "..."    ],    "detail": {        "tickets": [            ...         ],         ...    }}Hope my question made sense, thank you in advance for any answers!FollowComment"

Answer: "0Accepted AnswerI asked someone on the GameLift team via email about this topic and thought that it would be good to post his response here:Right, there are two pieces of important documentation; SNS notification format here, and the Flexmatch message format  here. The SNS notification contains the entire Flexmatch message in the “Message” field. Each has a timestamp. The SNS message timestamp field is called “Timestamp”, and is the ‘publish’ time when SNS received the message. The message had to be sent before that. And it had to be constructed even before that, so the Flexmatch message contains the “time” field, which should be earlier, when the Flexmatch message was constructed before it was sent.The Flexmatch message “time” field is therefore the one to use if comparing times.However...I don’t exactly know if these messages can be generated in parallel for a given ticketID, and frankly I doubt it, but subsequent messages can definitely be generated within a millisecond of each other, meaning that due to the resolution of the timestamp string (which is 1 millisecond), two messages can have the same timestamp on them, for the same ticket ID. Nothing stopping that, and I believe this is often what is happening for the customer.For example, I expect it to be  highly likely  that AcceptMatchCompleted is generated at almost the exact time that MatchmakingSucceeded is. It could be pretty common for their order to be ambiguous in SNS, and/or the “time” field to be identical in the Flexmatch messages.In the case that the tie can only be broken by the logical ordering of the message types.This order is:MatchmakingSearchingPotentialMatchCreatedAcceptMatch (noting that multple AcceptMatch can be generated, and if the time stamps are identical then they cannot be ordered)AcceptMatchCompletedMatchmakingSucceeded | MatchmakingCancelled | MatchmakingTimedOut |MatchmakingFailed (only one of these ‘final result’ notifications will be generated for any given ticket).My advice is only to subscribe to, and only to store the final result notification, if possible, as they are the only actionable ones. The others can be considered noise. If the game is using player acceptance ( e.g.  to implement a block list) then it must also subscribe to and respond to PotentialMatchCreated. In the SNS subscription, set up a ‘Subscription filter policy’ to only receive notifications of actionable types.If that doesn’t work for the customer, and it really should, then for those notifications whose type implies an order, then the Lambda should test the type of the message already stored and  ATOMICALLY  write the newly received one only if there is no later message stored as implied by the message type. This isn’t my preference for performance reasons, but it is a catch-all.I hope this is okay. If I have to credit the person who said this by name, then I will edit my post to do so. Just wasn't sure if he wanted to be highlighted in this forum post 😛CommentSharerePost-User-5100160answered 3 years ago"


Question: Encryption at rest - Amazon RDS for Oracle

"Hello friends,I plan to have RDS Oracle (SE2) which will have data for multiple clients.Let's say tables have data for multiple clients (client_id is a column in those tables) and each client wants to have its own encryption key.Is it possible to have a separate encryption key for each client?Is there a way to create partitions based on client ids and let each client use their encryption key?Thanks for your help.AbhiFollowComment"

Answer: "1Hello,Oracle SE2 as a product doesn't have the partitioning option available to it.If you used the Oracle Enterprise Edition with the Partitioning option licensed, then the following is useful to know: RDS is doing encryption at rest using Oracle TDE (Transparent Data Encryption) and Oracle TDE uses a two-tier encryption method with one single master key that encrypts multiple data keys, the data keys in turn encrypting the actual data. A customer can't control the data keys but can control (for example rotate) the master key.The answer to your question then would depend on your view on the meaning of "let each client use their encryption key". Technically if you partition the data per tablespace, then each tablespace will be using a separate data key, but ultimately a single master key.You'll need to see if that conforms to the requirement...RegardsCommentShareAWS-ADolganovanswered 7 months agorePost-User-2979373 7 months agoThank you for your reply @ADolganov.If I understood correctly, there will be only one master key irrespective of the number of partitions (for each client), and there is no way to have a separate master key for each partition so that each client can have control over the encryption of their data.I hope, I have explained the requirement (and not created any confusion)Thanks,AbhiShareAWS-ADolganov 7 months agoYes, this is a limitation of Oracle TDE, and it's unrelated to AWS RDS really. It would be the same on premises too if the TDE was used.One theoretical solution for you would involve encrypting data before it's sent to the database but it's a whole other can of worms and might require extensive application rework.SharerePost-User-2979373 7 months ago@ADolganov: Is it possible with AWS KMS?Share0Accepted Answer@ AWS-ADolganov: Is it possible with AWS KMS?CommentSharerePost-User-2979373answered 7 months agoAWS-ADolganov 7 months agoKMS couldn't help here because the limitation lies in the Oracle TDE.Share0Also check - https://aws.amazon.com/blogs/apn/oracle-database-encryption-options-on-amazon-rds/CommentSharerePost-User-1824542answered 7 months ago"


Question: Load balancer HTTPS to EC2 instance through HTTP

"I'm a bit confused as to why things are not really working out here.I have set up an AWS load balancer of type 'classic'. As a test I've set it up so that it listens to two EC2 instances running on port :8090, and I am currently getting the '2 of 2 instances in service' when looking at the load balancer information (HTTP health check on port :8090). For the load balancer listeners I have it set up in the following way:Load balancer protocol HTTP on port 8090 -> Instance protocol HTTP on port 8090Load balancer protocol HTTPS on port 443 -> Instance protocol HTTP on port 8090 with a certificate currently stored in the IAMThe security setting the for load balancer is accepting connections on 8090 and 443 while the security setting for the EC2 instances is accepting all connections from the load balancer.Browsing  to the load balancer on port :8090 properly returns the the application GUI that is running on the EC2 instance, port 8090. Browsing to the load balancer on port :443 however, simply gives me an ERR_EMPTY_RESPONSE. What am I missing here?All help is much appreciated!// JimmyEdited by: JimmyLarsson on Nov 20, 2019 9:52 AMJust me being silly trying to connect to it incorrectly, it works as expected...Edited by: JimmyLarsson on Dec 2, 2019 8:49 AMFollowComment"

Answer: "0Realized there was no problem, just me trying to connect to it by typing [DNS]:443 instead of https://[DNS] in the browser...CommentShareJimmyLarssonanswered 4 years ago"


Question: AWS compute savings plan commitment calculation

"I am trying to understand how the commitment per hour calculation has been done for AWS Savings plan recommendation for past 30 days. There is no document on how to calculate it, how is the calculation done for leaving the on-demand spend?As per the below usage of the services mentioned in below table, AWS cost explorer is recommending below commitment..."You could save an estimated $315 monthly by purchasing the recommended Compute Savings Plan.Based on your past 30 days of usage, we recommend purchasing 1 Savings Plan with a total commitment of $1.390/hour for a 1-year term. With this commitment, we project that you could save an average of $0.43/hour - representing a 17% savings compared to On-Demand. To account for variable usage patterns, this recommendation maximizes your savings by leaving an average $0.65/hour of On-Demand spend. Recommendations require up to 24 hours to update after a purchase."So we came to a conclusion that we should spend 0.65/hour of On-demand and 1.390/hour of commitment? Please suggest and share how we can calculate all this information if I need to do that with a different set of data.ServiceIntance familyinstance typeNo. of instancesRegionOn-demand Spend ($)On-demand UsageOn-demand rateSP rateSP Spend% discountEC2t2micro1US East (N. Virginia)8.3527200.01160.00785.61633%EC2t2nano1EU (Ireland)4.5367200.00630.00483.45624%EC2t2micro6EU (Ireland)53.8376584,272.830.01260000000.009540.59188525%EC2t2large1EU (Ireland)72.5767200.10080.076154.79225%EC2c6alarge1EU (Ireland)38.4495552468.440.082080.0585427.422477629%EC2c44xlarge1EU (Ireland)421.734660.9050.667310.82226%FargateGB-HoursEU (Ireland)224.987275550615.810.00444500000.0034671175.490074922%FargatevCPU-HoursEU (Ireland)916.932315222651.490.04048000000.0315744715.207205922%LambdaEU-Lambda-GB-Second (Second)EU (Ireland)28.2500591695000.150.00001666670.000013823.3910020717%LambdaEU-Request (Requests)EU (Ireland)0.944688540.20.200.940%**Total **1770.5908631.3633216671.05879531357.728645FollowComment"

Answer: "0First thing to remember is that the billing works hourly. It means that the system evaluates your usage for each hour in the last 7/30/60 days (depending on the recommendations term you select in Cost Explorer), and recommendations engine finds the most optimal $ commitment that would provide you the highest discount based on your past usage.Let's say you had some resources running on schedule. The system looks at your hourly on-demand spend for the recommendations term, which resources were running, and which discount % you would get for that usage if you had Savings Plans. SP discount applies to your usage each hour. If during some hours you run more resources than you reserved, any remaining usage will be charged on-demand. If during other hours you runn less, then some of the SP discount will be not utilized and cannot be used later in the month. Which means that depending on your usage patterns, you can either purchase SP to cover ALL your usage, but end up losing some of the discount, or you can purchase less SP but still pay some on-demand charges for spiky usage.If you wanted to calculate the same for a different set of data, there's no exactly easy native feature for that, but you would need to look at the SP pricing for resources that you want to reserve. For example, if you look at resources worth $0.5 hourly on-demand spend, then the amount of SP you have you reserve will depend on the % discount each of those resources get from SP.CommentShareEXPERTNataliya_Ganswered a year ago"


Question: AWS Cost Explorer API aggregate on USAGE_TYPE_GROUP

"Hello,I am trying to get the cost and usage data for an AWS Account using the GetCostAndUsage endpoint of the Cost Explorer API.During some investigations, I found out that the data is quite granular, and I would like to aggregate it on a higher level.The USAGE_TYPE_GROUP filter seems to be quite useful for this scenario. Unfortunately, it is only available as a filter and not all services are covered with it. Therefore, it is not that useful in my case.Is it possible or are there any plans for adding the USAGE_TYPE_GROUP as possible groupBy value? For known entities (e.g. EC2: Running Hours) it could just use them and for unknown entities N/A could be returned.Or are there any other possibilities to tackle that problem?Thanks for you feedback and helpFollowComment"

Answer: "0You might want to consider the Cloud Intelligence Dashboards which are deployed on top of the AWS Cost & Usage report (CUR). This will give you a scalable way to see a ton of insights into your spend, give you customizable visuals to understand your usage, track every dollar spent, see lots of cost optimization opportunities and visualize how much they'd save you and more. One of the dashboards, the Cost Intelligence Dashboard, has a Cost Explorer++ built in as well so you can continue to do ad hoc queries from a single pane of glass. The CUR is a super granular big data dump AWS can do into an S3 bucket up to 3 times a day, but it can be hard to parse so the dashboards make it really easy to access.CommentShareAaron Edellanswered a year agoAWS-User-7847976 a year agoThanks for the detailed explanation. Unfortunately, we are not able to use the Cloud Intelligence Dashboards because we want to operate on that data.It seems like the only option is to retrieve the data via the S3 bucket and not via an exposed AWS API because the GetCostAndUsage endpoint is not able to return all data, but you are only able to retrieve it using a filter and max. 2 groupBy arguments.Is my assumption right, or is there a way to easily consume it?Share"


Question: Global Table Replication

Have a global table created in east region and it gets replicated to west region for DR. When we create a lambda trigger on the stream it get triggered in both regions i.e. double replication. Is there a way to just trigger replication in east and not in west to avoid dual replication.FollowComment

Answer: 0The convention is to add an attribute (yourself) to store the region where the item was inserted/updated and have the Lambda only process items where the attribute is its local region. You can use Lambda event filtering to easily filter away non-local items before the Lambda is even invoked.CommentSharejzhunteranswered 7 months agorePost-User-0876660 7 months agoCan you please provide more information on how to do the filtering before lambda is invoked. Is lambda filtering supported on global tables.SharerePost-User-0876660 7 months agoCan you please provide more information on how to do the filtering before lambda is invoked. Is lambda filtering supported on global tables.Share


Question: How to create a client authoritive player for a multiplayer game

"Hello guys,i want to create a basic multiplayer game using gamelift, but i have some troubles creating something like a "player" which anyone connected to a gamelift session can control.I'm not sure how i can achieve this. First i thought i can just add a "Netbinding-Component" to my player prefab, but this doesnt work.Then i reversed engineered a bit the multiplayer sample and now i know how they implemented the player using client-authoritive data and rpc calls.But implementing something like this would take me a huge amount of time. Isn't there an easier way to create something like an "player" which gets replicated across the network for each connection?Do i really have to write my own C++ Server?Beside that i have some questions regarding the multiplayer-sample:1.) I couldn't figure it out how the game-server terminates game-sessions. When i tried this, you can create a session using the lobby but is there really no way to delete a session?2.) Created player-sessions get not disconnected aswell, that means with every new Connection from a Client to a game-session the amount of active player-sessions increased by one, but never decreased even when i terminated the client program.Thanks in advance :)Follow"

Answer: "0Accepted AnswerHi @REDACTEDUSERYou are on the right path! Adding a netbinding component is needed to "bind" an entity to the network so its data gets replicated. I posted a simple example of a networked player controller a little while ago: https://forums.awsgametech.com/t/networked-player-controller-example/2277/1The sample has lua code that needs to be updated to work with 1.9, but if this is something that you think would be useful for your game I'd be happy to update it for you.It is client-authoritative and each player that joins the server has their own character they control.Regarding your questions0.) Do you have to write your own C++ Server?Lumberyard comes with a dedicated server out of the box, so you don't need to write any C++ code if you just want to use Lua. That said, most multiplayer games do add/modify the C++ code for their dedicated server to optimize performance and to facilitate better security. If you are making a simple game where those are not issues (for example a prototype) then you don't need to write any C++ server code.1.) I couldn't figure it out how the game-server terminates game-sessions. When i tried this, you can create a session using the lobby but is there really no way to delete a session?There are C++ commands to terminate GameLift game sessions from the server, however in the multiplayer sample the dedicated server waits to receive a terminate message from GameLift before shutting down. So this means the client initiates the session creation, but GameLift handles the session termination in the sample. If you want your server to terminate the GameLift session you could call AWS::GameLift::Server::TerminateGameSession() (http://docs.aws.amazon.com/gamelift/latest/developerguide/integration-server-sdk-cpp-ref-actions.html#integration-server-sdk-cpp-ref-terminategamesession)2.) Created player-sessions get not disconnected aswell, that means with every new Connection from a Client to a game-session the amount of active player-sessions increased by one, but never decreased even when i terminated the client program.This sounds like the players are disconnecting incorrectly and the server has disconnect detection turned off? When a player disconnects the server is supposed to call Aws::GameLift::Server::RemovePlayerSession (line 247 of GameLiftServerSession.cpp in OnReplicaDeactivate).SharerePost-User-5841084answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-5738838answered 6 years ago0thanks :) i just need an easy way to instantiate a player for each connection to the gameserverSharerePost-User-6061869answered 6 years ago0Thanks, i'll try your character controller in the weekend.One last question regarding "0.) Do you have to write your own C++ Server?"Yea i know that lumberyard comes with a dedicated server out of the box and do the replication stuff etc. automatically, but say i am doing a prototype for my game, how does the server knows how to behave for this specific game? E.g. for a racing game the server has to manage obviously some sort of Leaderboard or handle when the race has been finished and transition all players to a new race. Is the only way to do this using C++?Edit:What i try to achieve is to spawn the controllable chicken from the samples project for each player, so each player can walk around. I tried this by just adding the netbinding-component to it, but the result of this is weird. The Chicken itself gets replicated from each client, but a cient is not able to move it (the server itself is able to move around but this chicken gets not replicated). Can you explain me why?SharerePost-User-6061869answered 6 years ago0Hi @REDACTEDUSERIf you want players to be able to control a character, either the client needs to spawn the character in which case the client owns it - or the server needs to spawn the character and only allow one client to control it. The first method is client-authoritative and is what the sample I posted does. Take a look at that setup to make sure you aren't spawning a slice that has a controller on it. You just want to spawn a single player controller for each client and spawn the pawn dynamically. It sounds like maybe you are dynamically spawning multiple player controllers.For the server-side logic you can start out with an entity that has a Lua script that only runs on the server. I typically expose the gEnv->pNetwork->IsDedicated() and gEnv->pNetwork->IsClient() to Lua so I can prototype quickly. However, this is not secure for a real game. The best way to secure your server logic is to only include that code on the dedicated server. You can implement that logic in Lua and load it (the compiled lua) on the server if you want, or just write it in C++.SharerePost-User-5841084answered 6 years ago"


Question: Migrating RDS PostgreSQL to Aurora PostgreSQL in a different account

"Hello,I have a customer who needs to move their RDS PostgreSQL database to a different account, and would like to migrate to Aurora while doing so. Just wanted to do a quick sanity check + see if there are simpler options available before I shoot over the following options to the customers.With downtimeTake snapshot of PostgreSQL databaseShare snapshot with new account following these steps (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Migrating.html#AuroraPostgreSQL.Migrating.RDSPostgreSQL.Import.Console)Create Aurora cluster from RDS PostgreSQL snapshotNo downtimeCreate Aurora cluster in new accountUse DMS to migrate data from RDS PostgreSQL to Aurora cluster in new account (https://aws.amazon.com/blogs/database/set-up-aws-dms-for-cross-account-migration/)The customer is running RDS PostgreSQL 10.13 at the moment.FollowComment"

Answer: "0Accepted AnswerLook into Amazon Aurora Fast Cloning as well. It supports Cross-account cloning via Resource Access Manager:https://aws.amazon.com/about-aws/whats-new/2019/07/amazon_aurora_supportscloningacrossawsaccounts-/https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Clone.html#Aurora.Managing.Clone.Cross-AccountPossible route to take, this will have downtime but will still be minimal, and doesn't require DMS or manually dealing with logical replication:Add an Aurora replica to the RDS pgsql DB instance on the same source account:  https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Migrating.html#AuroraPostgreSQL.Migrating.RDSPostgreSQL.Replicado additional testing on Aurora replica on this source account to check for any compatibility issuesAt time of cutover, create a clone of the Aurora DB cluster that will allow the clone to be created in the target accountperform DNS cutover to the cloned aurora DB clusterdelete/terminate source account Aurora DB cluster when appropriate, entirety of the storage will be billed now towards target accountHaving said that, to err on the safe side, I personally would recommend customer to separate this into 2 tasks and not try to group into one operation. One to upgrade to Aurora, and the second to create the fast DB clone cross-account. It will require 2 DNS cutover for the applications or require 2 updates in route 53 if you're using CNAMEs, but will likely make things clearer.CommentShareedchan-awsanswered 2 years ago"


Question: How to copy RDS database from Account A to Account B

"Perimeter is RDS for Oracle or Postgres, but the question can be intended with a wider scope, considering all RDS engines.Example: customer needs to copy a database from Prod account to Test account.The procedure is:create a manual snapshot of prod database in prod accountshare the snapshot with the test accountrestore the snapshot in the test accountbut there are limitations as explained here:Share manual Amazon RDS DB snapshots with another AWS accounthttps://aws.amazon.com/it/premiumsupport/knowledge-center/rds-snapshots-share-account/In particular this limitation:"You can't share manual snapshots of DB instances that use custom option groups with persistent or permanent options, such as Transparent Data Encryption (TDE) and time zone"Customer uses "custom option groups" with specific timezone different from default. Given that source database and target database will need the same timezone, is it possible to bypass the current limitation in a "cross-account snapshot share" context? this is really a severe limitation for the customer at moment. Any experience to share?ThanksFollowComment"

Answer: "0Dear Customer - Thanks for reaching out to us via AWS re:Post. First of all, allow me the opportunity to apologize for the delay in response to this post. I checked it just now and started working on it. I see that you wanted advice on copying database from one account to another when there is option group with persistent or permanent options attached - As a workaround you can create new instance without TDE option and copy data using EXPDP/IMPDP and then take snapshot of new instance and share it in different AWS account.Below are the high level steps required for this workaround .Create a new RDS instance with similar configuration but without any persistent/permanent optionsTake a export backup using datapump and copy the dump files to S3 using S3 integrationDownload the dump files in newly created instance and perform import using datapump.Now take snapshot of new instance having data importedShare this snapshot with any AWS account (as per your requirement)Kindly refer below document [B] for S3 integration, [C] for importing data in RDS Oracle.Stay safe and have a nice day ahead !References:[A] Limitation on TDE Snapshots.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Tutorials.RestoringFromSnapshot.htmlhttps://aws.amazon.com/premiumsupport/knowledge-center/rds-snapshots-share-account/[B] S3 Integration.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/oracle-s3-integration.html[C] Expdp/Impdphttps://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Oracle.Procedural.Importing.html#Oracle.Procedural.Importing.DataPump.S3[D] Import data from the dump created.https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Oracle.Procedural.Importing.html#Oracle.Procedural.Importing.DataPump.DBLinkCommentShareEXPERTNIRUPAM_danswered a year agoEXPERTkentradreviewed a year ago"


Question: Grant access to OpenSearch index

"I created a domain in OpenSearch and I've set the Access policy like the following:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"AWS": ""},"Action": "es:","Resource": "arn:aws:es:ca-central-1:xxxxxx:domain/xxxxx/*"}]}From what I understand I give access to all users but I am the only one who can browse the tab Indices in the console, my collegues get this error message:{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [indices:monitor/stats] and User [name=arn:aws:iam::xxxx:user/users/xyuser, backend_roles=[], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [indices:monitor/stats] and User [name=arn:aws:iam::xxx:user/users/xyuseri, backend_roles=[], requestedTenant=null]"},"status":403}They also get the same error message trying to perform queries with the REST APIPlease what am I missing?FollowComment"

Answer: "0Note that your Action is "es:" and not "es:"Add the "" to the Action section of your Access Policy.Here is an example:The following resource-based policy grants test-user full access (es:*) to the subresources on test-domain:{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"AWS": ["arn:aws:iam::123456789012:user/test-user"]},"Action": ["es:"],"Resource": "arn:aws:es:us-west-1:987654321098:domain/test-domain/"}]}CommentShareawsRickanswered a year agoAWS-User-4540940 a year agoHi Rick, thanks for your quick reply, I don'T know why the * was removed from my question but I do have "Action": "es:*"ShareAWS-User-4540940 a year agosee it won't paste ahh ;) I do have "Action": "es:star"ShareawsRick a year agoChange Principle to "Principal": "*"ShareawsRick a year agoDid this fix your issue?Share"


Question: Greengrass v2 Stream Manager and C++?

"What is the best way to use Stream Manager with a primarily C++ codebase? I can see in the documentation that the SDK is only available for Java and Python.The main thing we are looking to get out of Stream Manager is the ability to upload files to S3 in an unpredictable network environment. If there are alternate routes to achieving this via Greengrass outside of Stream Manager, that would also resolve the underlying goal of this question.We are willing to write additional adapter code to remain in C++ if needed. Is it feasible to use Stream Manager with C++ at all or should we look into alternate methods of getting files to S3 through Greengrass v2?FollowComment"

Answer: "1Accepted AnswerHi,one alternative is to write a small single purpose component written in one of the supported StreamManager SDK languages (I would suggest Java, since this is a prerequisite anyway to run StreamManager) that interacts with your main C++ component via Greengrass  pubsub IPC service.Another is to  have your Greengrass component written in C++ use the S3 API directly using the AWS SDK C++ but you will have to take care of the retries and backoffs in case of lack of connectivity.CommentShareEXPERTMassimilianoAWSanswered 2 months agoEXPERTAWS-User-Nitinreviewed a month agopatwolfe 2 months agoThat makes sense and is more or less what I figured - thanks Massimiliano!Share"


Question: Is it possible to turn off strict SQL mode in RDS for MySQL v8.0?

"Is it possible to turn off strict SQL mode in RDS for MySQL v8.0?I noticed it has a fixed value of STRICT_TRANS_TABLES even though the parameter sql_mode is only set on NO_ENGINE_SUBSTITUTIONI'm asking because MySQL already deprecated NO_ZERO_DATE, NO_ZERO_IN_DATE and announced that in the future they will be merged into strict mode which potentially could break our applications.FollowComment"

Answer: "0Accepted AnswerStrict mode is OFF by default on RDS MySQL 8, we have sql_mode=NO_ENGINE_SUBSTITUTION only. As long as you do not add any of STRICT_TRANS_TABLES (when merged) or NO_ZERO_DATE or NO_ZERO_IN_DATE in your sql_mode, it should not break your application in the future.We recommend however to use strict mode when possible to avoid subtle data inconsistencies in the future.CommentShareawsjervinanswered 13 days agoYoni Sade 13 days agoBut when I run against the instance:"show variables like 'sql_mode'"I get the value:"STRICT_TRANS_TABLES,NO_ENGINE_SUBSTITUTION"even though in the param group only the value NO_ENGINE_SUBSTITUTION was definedShareawsjervin 12 days agoYou might be looking at your session variables. Does executing these queries show differences?SELECT @@session.sql_mode;SELECT @@global.sql_mode;If they do differ, then your client connection may be setting a custom SQL mode during connection. You will need to make sure your application does not do the same.ShareYoni Sade 11 days agoThanks, indeed my JDBC client added it on session start.I solved it by setting the "jdbcCompliantTruncation" key to "false" in the driver properties.Share"


Question: AWS Greengrass v2 - Windows 10

"Hi there,I have a problem when I am installing the AWS Greengrass package on a Windows 10 OS. I have followed all the steps provided by the AWS Greengrass set-up webpage, but unfortunatelly, it does not work.The set-up command I am writing:java "-Droot=C:\greengrass\v2" "-Dlog.store=FILE" -jar .\lib\Greengrass.jar --init-config .\config-CoreDevice01.yaml --component-default-user ggc_user --setup-system-service trueThe output from the program:Error while trying to setup Greengrass Nucleusjava.lang.RuntimeException: Cannot create all required directoriesat com.aws.greengrass.lifecyclemanager.KernelCommandLine.initPaths(KernelCommandLine.java:191)at com.aws.greengrass.lifecyclemanager.KernelCommandLine.lambda$parseArgs$0(KernelCommandLine.java:147)at com.aws.greengrass.config.Topic.subscribe(Topic.java:50)at com.aws.greengrass.lifecyclemanager.KernelCommandLine.parseArgs(KernelCommandLine.java:147)at com.aws.greengrass.lifecyclemanager.Kernel.parseArgs(Kernel.java:591)at com.aws.greengrass.easysetup.GreengrassSetup.performSetup(GreengrassSetup.java:296)at com.aws.greengrass.easysetup.GreengrassSetup.main(GreengrassSetup.java:269)Caused by: java.nio.file.attribute.UserPrincipalNotFoundExceptionat java.base/sun.nio.fs.WindowsUserPrincipals.lookup(WindowsUserPrincipals.java:147)at java.base/sun.nio.fs.WindowsFileSystem$LookupService$1.lookupPrincipalByGroupName(WindowsFileSystem.java:250)at com.aws.greengrass.util.platforms.windows.WindowsPlatform$WindowsFileSystemPermissionView.aclEntries(WindowsPlatform.java:413)at com.aws.greengrass.util.platforms.windows.WindowsPlatform$WindowsFileSystemPermissionView.<init>(WindowsPlatform.java:326)at com.aws.greengrass.util.platforms.windows.WindowsPlatform.getFileSystemPermissionView(WindowsPlatform.java:458)at com.aws.greengrass.util.platforms.Platform.setPermissions(Platform.java:167)at com.aws.greengrass.util.platforms.Platform.setPermissions(Platform.java:129)at com.aws.greengrass.util.Permissions.setRootPermission(Permissions.java:93)at com.aws.greengrass.util.NucleusPaths.setRootPath(NucleusPaths.java:99)at com.aws.greengrass.lifecyclemanager.KernelCommandLine.initPaths(KernelCommandLine.java:170)The yaml file:system:certificateFilePath: "C:\greengrass\v2\X.cert.pem"privateKeyPath: "C:\greengrass\v2\Y.private.key"rootCaPath: "C:\greengrass\v2\AmazonRootCA1.pem"rootpath: "C:\greengrass\v2"thingName: "co2sink-dev-CoreDevice01"services:aws.greengrass.Nucleus:componentType: "NUCLEUS"version: "2.5.2"configuration:awsRegion: "eu-west-1"iotRoleAlias: "co2sink-dev-TokenExchangeRoleAlias"iotDataEndpoint: "aa598pljtwur1-ats.iot.eu-west-1.amazonaws.com"iotCredEndpoint: "cszj6chx6z301.credentials.iot.eu-west-1.amazonaws.com"I hope you could help, looking forward to hearing from you.Kind regards.Daniel.FollowComment"

Answer: "0Hi all,I have seen the following link explaining the issue (or what it appears to be so):https://stackoverflow.com/questions/70419534/aws-greengrass-installation-on-windows-cannot-create-all-required-directoriesIt seems that building the AWS Greengrass nucleus source code from scratch fixes it, but changing the OS Windows language to English. In any case, when I include a new component to the implementation (specifically, the aws.greengrass.LogManager component), it crashes forever, being imposible to be restarted in any case... and if I take a look to the log, the output is practically the same as my previous post.Does the issue affect to all components as well? Is there something extra I should take into consideration?Thanks beforehand, looking forward to hearing from you.Kind regards.Daniel.CommentSharedpergarcanswered a year agoTiloChen-Aws a year agoHi, for the LogManager issue, can you also share the error log/stack trace? That'll be helpful for us to determine the cause. By "include a new component to the implementation", do you mean you're deploying the component? What deployment method did you use (thing/thing group/local)?Share0This non-English Windows issue has been fixed but not released yet. Before that, you may develop with a Nucleus built from source.The reason you're seeing the same error again after deploying LogManger is that, during deployment, the Nucleus version gets resolved again because LogManger depends on it. The version resolution process will return latest public version which is 2.5.3 right now. It'll then overwrite your custom-built nucleus with 2.5.3, which fails to restart because it doesn't contain the fix.The solution before the fix is released would be creating a private Nucleus version in your account, for example version 2.5.49. Then when you deploy LogManager, it won't overwrite nucleus with a version that doesn't have the fix. Remember to change the version in conf/recipe.yaml when you build nucleus from source.Recipe you may use to help create a private Nucleus version:{  "RecipeFormatVersion": "2020-01-25",  "ComponentName": "aws.greengrass.Nucleus",  "ComponentVersion": "2.5.49",  "ComponentType": "aws.greengrass.nucleus",  "ComponentDescription": "Core functionality for device side orchestration of deployments and lifecycle management for execution of Greengrass components and applications. This includes features such as starting, stopping, and monitoring execution of components and apps, interprocess communication server for communication between components, component installation and configuration management.",  "ComponentPublisher": "AWS",  "ComponentConfiguration": {    "DefaultConfiguration": {      "jvmOptions": "",      "iotDataEndpoint": "",      "iotCredEndpoint": "",      "greengrassDataPlanePort": "8443",      "awsRegion": "",      "iotRoleAlias": "",      "mqtt": {},      "networkProxy": {},      "runWithDefault": {},      "deploymentPollingFrequencySeconds": "15",      "componentStoreMaxSizeBytes": "10000000000",      "platformOverride": {}    }  },  "Manifests": [    {      "Platform": {        "os": "linux"      },      "Lifecycle": {        "bootstrap": {          "requiresPrivilege": true,          "script": "\nset -eu\nKERNEL_ROOT=\"{kernel:rootPath}\"\nUNPACK_DIR=\"{artifacts:decompressedPath}/aws.greengrass.nucleus\"\nrm -r \"$KERNEL_ROOT\"/alts/current/*\necho \"{configuration:/jvmOptions}\" > \"$KERNEL_ROOT/alts/current/launch.params\"\nln -sf \"$UNPACK_DIR\" \"$KERNEL_ROOT/alts/current/distro\"\nexit 100"        }      },      "Artifacts": [        {          "Uri": "s3://gg-test-artifacts/custom-nuc-2.5.49/aws.greengrass.nucleus.zip",          "Unarchive": "ZIP",          "Permission": {            "Read": "ALL",            "Execute": "ALL"          }        }      ]    },    {      "Platform": {        "os": "darwin"      },      "Lifecycle": {        "bootstrap": {          "requiresPrivilege": true,          "script": "\nset -eu\nKERNEL_ROOT=\"{kernel:rootPath}\"\nUNPACK_DIR=\"{artifacts:decompressedPath}/aws.greengrass.nucleus\"\nrm -r \"$KERNEL_ROOT\"/alts/current/*\necho \"{configuration:/jvmOptions}\" > \"$KERNEL_ROOT/alts/current/launch.params\"\nln -sf \"$UNPACK_DIR\" \"$KERNEL_ROOT/alts/current/distro\"\nexit 100"        }      },      "Artifacts": [        {          "Uri": "s3://gg-test-artifacts/custom-nuc-2.5.49/aws.greengrass.nucleus.zip",          "Unarchive": "ZIP",          "Permission": {            "Read": "ALL",            "Execute": "ALL"          }        }      ]    },    {      "Platform": {        "os": "windows"      },      "Lifecycle": {        "bootstrap": {          "requiresPrivilege": true,          "script": "copy {kernel:rootPath}\\alts\\current\\distro\\bin\\greengrass.xml {artifacts:decompressedPath}\\aws.greengrass.nucleus\\bin\\greengrass.xml& del /q {kernel:rootPath}\\alts\\current\\*&& for /d %x in ({kernel:rootPath}\\alts\\current\\*) do @rd /s /q \"%x\"&& echo {configuration:/jvmOptions} > {kernel:rootPath}\\alts\\current\\launch.params&& mklink /d {kernel:rootPath}\\alts\\current\\distro {artifacts:decompressedPath}\\aws.greengrass.nucleus&& exit 100"        }      },      "Artifacts": [        {          "Uri": "s3://gg-test-artifacts/custom-nuc-2.5.49/aws.greengrass.nucleus.zip",          "Unarchive": "ZIP",          "Permission": {            "Read": "ALL",            "Execute": "ALL"          }        }      ]    }  ],  "Lifecycle": {}}CommentShareTiloChen-Awsanswered a year ago"


Question: Course Material

will i still have access to the course materials after i get the aws cloud practitioner certificate?FollowComment

Answer: "1Accepted AnswerIf you took the AWS Cloud Practitioner Essentials class from AWS, the classroom material is available for 730 days in your digital library, independent of passing the exam.CommentShareEXPERTkentradanswered 7 months agoEXPERTTushar_Jreviewed 7 months agorePost-User-2845719 7 months agoWhat do mean by "AWS Cloud Practitioner Essentials class from AWS",Could you provide a screenshot for the syllabus?ShareTushar_J EXPERT7 months agoThis is the link: https://aws.amazon.com/training/digital/aws-cloud-practitioner-essentials/Share"


Question: WebsocketApi Lambda and connect ECONNREFUSED

"Hello,I've been setting up Websocket API with Lambda and I received following error:<message-id>INFOError: connect ECONNREFUSED <ip>    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1300:16) {  errno: -111,  code: 'ECONNREFUSED',  syscall: 'connect',  address: <ip>,  port: 80,  '$metadata': { attempts: 1, totalRetryDelay: 0 }Env is a Node18 and Postman (ws) as a client.Lambda's code:import { ApiGatewayManagementApiClient, DeleteConnectionCommand,PostToConnectionCommand } from "@aws-sdk/client-apigatewaymanagementapi";const api = new ApiGatewayManagementApiClient({endpoint: 'wss://<id>.execute-api.<region>.amazonaws.com/production',    region: 'eu-central-1'})export const handler = async (event) => {            console.log(event);        const {routeKey, connectionId} = event?.requestContext    let msg;        console.log(`Request key is ${routeKey} and connectionID is ${connectionId}`)        switch(routeKey){        case '$connect':            msg = 'connected My friend';            break;                    case '$disconnect':            msg = 'disconnected my friend';            break;                    case 'message':            try{                await replyToMessage(connectionId, 'RAMP PAM PAM')            }catch(e){                console.log('EXEPTION ALARM')                console.log(e)            }            break;                    default:            console.log('something bad happened', routeKey);            break;    }        // TODO implement    const response = {        statusCode: 200    };            return response;};const replyToMessage = (ConnectionId, message) =>{        const data = {message};        const cmd = new PostToConnectionCommand({            ConnectionId,            Data: Buffer.from(JSON.stringify(data))        })                const result =  api.send(cmd);        console.log(result)        return result;    }Lambda's policy{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "execute-api:*",            "Resource": "arn:aws:execute-api:<region><id>:<api-id>/production/*"        }    ]}Thank you in advance,Arczik!FollowComment"

Answer: 0I think you getting this error on the client side. Is it correct? The error indicates that you are trying to connect over port 80. API Gateway only supports port 443 using wss: protocol. I am guessing this is the reason for the error.CommentShareEXPERTUrianswered 6 months agoArczik 6 months ago@Uri thank you for your answer. In Postman I have a 'wss:/'/ prefix before api url. I get above mentioned error in 'replyToMessage' when I try to send message back to client.Share


Question: AWS EKS - CloudFormation Script fails (just the documented tutorial with no changes)

"Summary:I have successfully deployed EKS via AWS Cloudformation template in the past (about an year ago).Now when I am trying to deploy EKS via AWS Cloudformation its failing.The error message is NOT clear enough for me to go and fix the reason of the crash, any tips on how to go about this error message?Documentation and Steps UsedPage: https://aws.amazon.com/quickstart/architecture/amazon-eks/Deploy using AWS CloudFormation with new VPCError MessageStack nameStatuseks-quickstart-RegionalSharedResourcesDELETE_FAILEDeks-quickstart-AccountSharedResourcesCREATE_COMPLETEAmazon-EKSROLLBACK_COMPLETEAmazon EKS (ROLLBACK_COMPLETE) has the following events that FailedAutoDetectSharedResources > CREATE_FAILED with logEmbedded stack arn:aws:cloudformation:us-east-2:SOME_ID : stack/Amazon-EKS-AutoDetectSharedResources-SOME_UUID was not successfully created: The following resource(s) failed to create: [ PreReqs ].Amazon-EKS > ROLLBACK_IN_PROGRESS with logThe following resource(s) failed to create: [AutoDetectSharedResources]. Rollback requested by user.One more log seems to be important (BUT the Cloudformation Script is from AWS so I doubt it might be a root cause)RegisterHelmType  CREATE_FAILEDCloudFormation did not receive a response from your Custom Resource. Please check your logs for requestId [SOME_UUID]. If you are using the Python cfn-response module, you may need to update your Lambda function code so that CloudFormation can attach the updated version.FollowComment"

Answer: "0To detect issue properly it would help to avoid rolling back. You can try that usingaws cloudformation create-stack --stack-name myteststack --template-body file://DOC-EXAMPLE-BUCKET.json -–disable-rollbackCommentShareMadhav_Panswered a year ago0Hi,We are facing the same issue in our accounts to create an EKS service. Basically the lambda fails:"Reason": "UnknownEndpoint: Inaccessible host: lambda.eu-west-1.amazonaws.com' at port undefined'. This service may not be available in the `eu-west-1' region.\n    at Request.ENOTFOUND_ERROR (/var/runtime/node_modules/aws-sdk/lib/event_listeners.js:529:46)\n    at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)\n    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10)\n    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:686:14)\n    at error (/var/runtime/node_modules/aws-sdk/lib/event_listeners.js:361:22)\n    at ClientRequest.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/http/node.js:99:9)\n    at ClientRequest.emit (events.js:400:28)\n    at ClientRequest.emit (domain.js:475:12)\n    at TLSSocket.socketErrorListener (_http_client.js:475:9)\n    at TLSSocket.emit (events.js:400:28)",The step that returns this error is Authentication Manifest.regards,NunoCommentSharerePost-User-2627288answered 6 months ago"


Question: Amazon Transcribe > Custom Vocabulary

"I am creating a custom vocabulary in Amazon Transcribe and readind the Amazon TranscribeDeveloper Guide. In the documentation there is a sintax example to create a new custom vocabulary.Example: ( replace [TAB] to tab and remove the spaces between the columnsLos-Angeles[TAB][TAB]l # s æ n # # l # s[TAB]Los AngelesEva-Maria [TAB]ay-va-ma-ree-ah[TAB][TAB]A.B.C.-s[TAB]ay-bee-sees[TAB]ABCsAmazon-dot-com[TAB][TAB][TAB]Amazon.comC.L.I.[TAB][TAB]s # # l a#[TAB]CLIAndorra-la-Vella[TAB]ann-do-rah-la-bay-ah[TAB][TAB]Andorra la VellaDynamo-D.B.[TAB][TAB][TAB]DynamoDBWhen i try to create the vocabulary with a example, the AWS gives me an error:Failure reasonThe vocabulary that you’re trying to create contains invalid characters or incorrectly formatted terms. See the developer guide for more information.I tried many times but it didn't work.The only a unique way that worked was when i did as bellow:Los-Angeles[TAB][TAB][TAB]Eva-Maria[TAB][TAB][TAB]A.B.C.-s[TAB][TAB][TAB]Amazon-dot-com[TAB][TAB][TAB]C.L.I.[TAB][TAB][TAB]Andorra-la-Vella[TAB][TAB][TAB]Dynamo-D.B.[TAB][TAB][TAB]Without use the columns SoundsLike, IPA, DisplayAsPlease, someone help me.FollowComment"

Answer: "0Hey!As stated on the documentation "You must save your table as a text (.txt) file and upload it into an Amazon S3 bucket before you can convert it into a useable vocabulary." *Once you do this, the example provided should work! Remember also: "Only use spaces within the IPA and DisplayAs columns. Separate columns with a TAB character. Do not use spaces to separate columns; doing so results in an error."CommentShareDani Manswered a year ago"


Question: Connecting to  Postgres Amazon RDS  using IAM authentication

"Hi all,I am trying to set us IAM authentication to connect to my Postgres RDS 14.2 instance. I am following https://aws.amazon.com/premiumsupport/knowledge-center/rds-postgresql-connect-using-iam/ to set things up. I can connect to the instance using the authentication token without performing any of the IAM tasks which are mentioned in the document.  The following are the steps I followed.Create a Postgres 14.2 instanceEnable IAM authentication on the instanceLogin to my instance and create a DB user with login and grant rds_iam to the user.Generate the authentication token for the user.Login to the instance with the generated authentication token.I was able to login to the instance without any issue. If you notice the above steps I did not create an IAM user nor have I created or attached any policy as mentioned in the documentation. Am I missing something? I don't this that is how it is expected to work.Thanks,KrisFollowComment"

Answer: 0I think I have found the issue. I have been generating the token as root user rather than the IAM user. I think thats why I am able to login to the instance as the user without doing anyting related to the IAM config.CommentSharekrisanswered 10 months ago


Question: S3FileTransformOperator: Permission denied on script

"This is what is happening:Given I have a file at dags/transform,py containing a script to transform a fileWhen I execute the S3FileTransformOperator with the file as a parameterThen the task failed with [Errno 13] Permission denied: 'dags/transform.py'When running on a local machine, or on self-hosted Airflow, I am able to chmod +x the file which resolves the issueWhat are my options on MWAA?FollowComment"

Answer: "0Hi!Unfortunately with MWAA the worker containers are both ephemeral and limited to user level access.  The S3 operator should work with .sh files added to the /dags folder and referred to in the operator as /usr/local/airflow/dags/my_script.sh.  The alternative would be to use the contents of your .py file from a Python operator and use the S3Hook to retrieve and store the file.Thanks!CommentShareJohn_Janswered 2 years ago0AWS support provided a work-around that involves changing the execute permissions of the file using an operator (i.e. using the Bash operator running CHMOD)CommentSharejaimalchohanwsanswered 2 years ago0This fix has stopped work as of today.Not sure what AWS updated.CommentSharejaimalchohanwsanswered 2 years ago0Hi,If you place a file called "test.sh" in your dags folder and call it with an operator like this:shell_test = BashOperator(      task_id="shell_test",      bash_command="sh '/usr/local/airflow/dags/test.sh'"  )  It should work fine.  Running chmod will not be persistent, because as soon as the worker is scaled or replaced for any reasons then your changes will be reverted.Thanks!CommentShareJohn_Janswered 2 years ago"


Question: AWS ORGANIZATIONS

been working on AWS ORGANIZATIONS..i've my root account(management account) under that i've one vendor accountnow in management account i've 2 ec2 instance resource..with switch role from vendor account to management account..i should only see one ec2 instance among that 2 instance that already available in management account.now how can i apply policies to do this..i tried tag policies to do this which only restrict the vendor to do things..but for my use case i should hide one ec2 instance and show only one ec2 instance by vendor account..how can i do with?FollowComment

Answer: "2Accepted AnswerYou can do that by delegate access across AWS accounts using IAM roles.Use AWS Mgmt Console to establish trust between the Mgmt and Vendor account. Create a IAM role named e.g. vendorARole. When you create the role, you define the Vendor account as a trusted entity and specify a permission policy that allows trusted users to access only one of the EC2 instance via tagging.You can see a similar steps for sharing of S3 bucket across account at:https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.htmlCommentShareronald_lanswered 9 months ago"


Question: Please add TDL ".ag" to Route53

"We have a ".ag" domain we wish to transfer to Route53, but ".ag" does not appear to be in the list of supported top level domains. Would it be possible to add it?FollowComment"

Answer: "0Hi,The domain .ag does NOT include in the support list (https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar-tld-list.html).However, you can register .charity domain in the supported registrar (eg. Godaddy), point your .charity domain from Godaddy to Amazon Route 53 and manage your subdomains in Amazon Route 53.For quick procedure steps:1/ Go to Amazon Route 53 Hosted Zone and Create Hosted Zone.2/ Add your domain name (*.ag) for public hosted zone.3/ Save to obtain name servers (NS).4/ Go to your Godaddy Account and Product Manager.5/ Click on DNS option for the domain you want to point.6/ Click on Change Nameserver, and “Enter my own Nameserver”.7/ Copy the nameservers from route 53 to the given fields and Save.8/ It may take some time but you are ready to use this domain in any of the aws service by creating “A” record in your route 53 hosted zone.BRCommentSharejcvipanswered 9 months ago"


Question: can we attach the custom domain to lambda function urls ?

can we attach the custom domain to lambda function urls ? I assume we can create the custom domain in route53 and we can link the custom domain to the function urls. Will this work ? or are there any better alternatives to do this ? Or any challenge in linking custom domain in Route53 with function urls ?I understand we can attach the lambda with API GW to attach the custom domain. But I don't want to go to API gateway again and attach the custom domain to API Gateway. The whole point of function urls and this questions is to avoid using the API GW on top of lambda.FollowComment

Answer: "2Accepted AnswerLambda function URLs are intended to be very lightweight way if invoking Lambda functions. They have limited capabilities, custom domain names is not one of them. Creating an alias in Route53 will not help as the Lambda service will not know which function it needs to invoke.If you need custom domain names, use API Gateway instead.CommentShareEXPERTUrianswered a year agoKevinL_AWS a year agoYou can also consider putting your custom domain name on CloudFront or a public ALB.Share"


Question: M of N authentication for signing/encrypting operations

"Hello,Reading the user guides to manage keys, I see it is possible to create keys that can only be used following the M of N Access Control (e.g. in https://docs.aws.amazon.com/cloudhsm/latest/userguide/key_mgmt_util-genRSAKeyPair.html). However, it seems the generation and provision of the token with the signatures of all the users required is only done via the key management client application.Is this correct? Is there any other possibility that does not involve the interactive console based key management client? Looking into the Java library provided I don't see any class/method to manage the keys that includes anything about the M of N Access Control.Best,JordiFollowComment"

Answer: "0Accepted AnswerHi JordiCJ,Reading the user guides to manage keys, I see it is possible to create keys that can only be used > following the M of N Access Control (e.g. in https://docs.aws.amazon.com/cloudhsm/latest/userguide/key_mgmt_util-genRSAKeyPair.html). However, it seems the generation and provision of the token with the signatures of all the users required is only done via the key management client application.That's true, the initial configuration of a new CloudHSM Cluster must be done using the CLI tools, but it's generally only ever done once per cluster, so we don't currently provide a mechanism to do this programmatically. That said, you can certainly script the process (note the 'singleCommand' directive in the Key Management Utility) but be careful about how you manage sensitive parameters. We don't recommend this generally.Is this correct? Is there any other possibility that does not involve the interactive console based key management client? Looking into the Java library provided I don't see any class/method to manage the keys that includes anything about the M of N Access Control.Unfortunately, neither the standard Java JCA interface nor the PKCS#11 standard provide a reasonable way to manage quorum (MofN) operations. While it's possible for us to provide a utility library that could offer this functionality, feedback from customers has been that managing and using MofN keys is a predominantly "human" activity, thereby making the CLI the most natural tool for it. We recognize that some more sophisticated customers may want to build quorum functionality into custom applications directly, and we are working on some great new capabilities that, among other things, would allow customers to do exactly this. Keep an eye out for future announcements!Thanks,the CloudHSM teamCommentShareavniatawsanswered 4 years ago0Thank you for your response!We are probably one of these sophisticated users you mentioned. In our case we really need to have a utility library to do these operations, because the users of our product need to do (and some of them observe for auditing purposes) these operations in an easy and understandable manner (both during the generation of the keys and the usage of them).CommentShareJordiCJanswered 4 years ago0Thanks for writing - we want to explore your requirements in depth. Please send your contact information via a support case (you can open one through your AWS console), and we'll set up a call with you.Sincerely,Avni RambhiaProduct Manager, AWS CloudHSMCommentShareavniatawsanswered 4 years ago0Hello,I am sorry to tell you despite having tried several times to contact the customer service via a case, they do not want to send you my contact information in order to set up the call you would like to do to better understand our requirements.Best,Jordi.CommentShareJordiCJanswered 3 years ago"


Question: Athena Glue service logs tool and dedup or overwrite of entries in converted logs

"I opened a an issue about this problem as well, https://github.com/awslabs/athena-glue-service-logs/issues/32We have been attempting to partition our S3 access logs to make them easier to query and found the above tool to be a viable solution. However, we encountered a problem where certain S3 actions use the same request ID which causes the partitioned parquet logs to not contain the same data as in the input logs. They appear to be deduped out or overwritten.Input log entries9d306c3478cf2e54f72d7f972c2e7090d30324572b78f1901d30a5d89e33cbe8 BUCKET_NAME [02/May/2023:19:19:55 +0000] 52.12.241.113 IAM_ARN_HERE 1C25EZNCB2HBMQQY BATCH.DELETE.OBJECT f1683055189142x766494105173435800/IMG_1138.jpeg - 204 - - - - - - - - Pad2oayPBK9Yqw9/BWjhgn84fAsgRK7OTjjRFTy8Nuzlr27Ou+InFTsEf3eJsOaOkr2jw9xLBUa6d1tHwjf+xg== SigV2 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader s3.amazonaws.com TLSv1.2 - -9d306c3478cf2e54f72d7f972c2e7090d30324572b78f1901d30a5d89e33cbe8 BUCKET_NAME [02/May/2023:19:19:55 +0000] 52.12.241.113 IAM_ARN_HERE 1C25EZNCB2HBMQQY REST.POST.MULTI_OBJECT_DELETE - "POST /BUCKET_NAME/?delete HTTP/1.1" 200 - 305 - 29 - "-" "-" - Pad2oayPBK9Yqw9/BWjhgn84fAsgRK7OTjjRFTy8Nuzlr27Ou+InFTsEf3eJsOaOkr2jw9xLBUa6d1tHwjf+xg== SigV2 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader s3.amazonaws.com TLSv1.2 - -The Athena query for the request ID returns the following:9d306c3478cf2e54f72d7f972c2e7090d30324572b78f1901d30a5d89e33cbe8BUCKET_NAME2023-05-02 19:19:55.00052.12.241.113IAM_ARN_HERE1C25EZNCB2HBMQQYREST.POST.MULTI_OBJECT_DELETEPOST /BUCKET_NAME/?delete HTTP/1.120030529Pad2oayPBK9Yqw9/BWjhgn84fAsgRK7OTjjRFTy8Nuzlr27Ou+InFTsEf3eJsOaOkr2jw9xLBUa6d1tHwjf+xg==SigV2ECDHE-RSA-AES128-GCM-SHA256TLSv1.2 - -20230502The object being deleted is lost in the output format.Due to the volume of S3 access logs, triggering a lambda on each object create is not a great option for us and we do not need the conversion to happen immediately. Has anyone worked around this problem or have a solution where a Glue job can properly output partitioned logs while not losing data?I am going to be working on a Python script solution but I am curious if anyone has done this already.FollowComment"

Answer: "0When you partition the data, the partition column is no longer in the data file but in the path name.If your table is correctly define, that partition column should be listed with the rest of the column in the results (from the query point of view, it's no different to other columns other than performance)CommentShareGonzalo Herrerosanswered a month agoMike Plemmons a month agoThe concern here is the contents of the output file. All the heavy lifting is done by the tool. It takes a source bucket of the S3 access logs and then processes the files into the partitioned prefixes and outputs parquet files. The input S3 access log has two entries for a delete but the output file only has 1 entry. The loss of the other entry is problematic since that entry has more relevant detail.ShareGonzalo Herreros a month agoTo troubleshoot a row lost you cannot do it that way (since it's lost), you would need to trace at which point of the pipeline is lost (possibly deduplicated), for instance printing the number of records in the data with that delete event from the moment the data is read till it is writtenShareMike Plemmons a month agoWe are in agreement. My original question was to determine if others had already encountered this problem and had an answer. I have been attempting to debug the code and have been running into difficulties but I continue to troubleshoot.Share"


Question: Blazor and Cognito

trying to get a blazor server app to authenticate against cognito using Blazor.Auth0user pool is working (can log in with the hosted ui) but when i run the app i get error 400 and the url showshttps://domain.auth.us-east-2.amazoncognito.com/error?error=redirect_mismatch&client_id=MYCLIENTIDwhen i use the hosted ui it calls my callback gets redirected to https then calls authorize on the oauth2 domain and then calls/shows the domain abovesure something simple is just not configured correctly. any tips on what to look for?any help greatly appreciatedMikeFollowComment

Answer: 0switched the app to using Microsofts OpenIdConnect and was able to get it to workCommentSharestarzenanswered 2 years ago


Question: how to add tracking to sagemaker experiments and training jobs?

"regarding sagemaker experiments, we can add additonal arguments or parameters as  part of tracking for sagemaker experiments . is there anything similar for sagemaker training jobs?from smexperiments.tracker import tracker with Tracker.create(...) as tracker:   tracker.log_parameters (....      FollowComment"

Answer: 0SageMaker Experiments Documentation: https://docs.aws.amazon.com/sagemaker/latest/dg/experiments.htmlsmexperiments.tracker module: https://sagemaker.readthedocs.io/en/stable/amazon_sagemaker_experiments.html#smexperiments.trackerSageMaker Python SDK Estimator class: https://sagemaker.readthedocs.io/en/stable/api/training/estimators.htmlSageMaker Python SDK TrainingInput class: https://sagemaker.readthedocs.io/en/stable/api/training/inputs.htmlCommentSharerePost-User-5208427answered 2 months ago


Question: The security token included in the request is invalid on request to dynamoDB from Elastic beanstalk

"Hello,I have Beanstalk app which trying to call dynamoDB, my code is copied from this docs -> https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/dynamodb-example-query-scan.html i'm trying to perform query operation and get error The security token included in the request is invalidWhen i login to ec2 this app is running on and install aws-cli i can perform dynamoDB operationsI have no access key and secret set in EB directly, do you have any ideas why i get this error ?FollowComment"

Answer: "1You must always have credentials to access other systems, no matter if its within AWS Org or not. You're ElasticBeanstalk should have a valid IAM role with adequate permissions to make requests to DynamoDB.https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/iam-instanceprofile.htmlEnsure that you follow the credential chain and you do not have configured stale credentials higher up the chain which can lead to issues.CommentShareEXPERTLeeroy Hannigananswered 2 months agokstozek 2 months agoI have it configuredextended_ec2_policy_document = <<EOF{  "Statement": [      {          "Action": [              "dynamodb:PutItem",              "dynamodb:BatchWriteItem",              "dynamodb:GetItem",              "dynamodb:BatchGetItem",              "dynamodb:Query",              "dynamodb:UpdateItem",              "dynamodb:DeleteItem"          ],          "Effect": "Allow",          "Resource": "dynamoDB arn",          "Sid": "some sid"      }  ],  "Version": "2012-10-17"}EOF}Sharekstozek 2 months agoAWS cli is working on ec2 with this app so i believe there is no problem with keys / credentialsShareLeeroy Hannigan EXPERT2 months agoThe CLI is very likely using different credentials. In your app, call GetCallerIdentity https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html`Sharekstozek 2 months agoTried that, and get the same error about security tokenShareLeeroy Hannigan EXPERT2 months agoSSH to your ElasticBeanstalk instance and export credentials using the CLI. This is the first in the chain and will solve your issue.ShareShow 4 more comments"


Question: Workspace loses connection to WorkDocs when I log out

"Hi there,Here is my setup:Workspace (Windows Server 2016) running mode set to Always OnKeep me logged in check box selectedWorkDocs Drive installed in the Workspace, set to automatically log inWhen I log into the Workspace, Workdocs drive mounts correctly on W: as expectedThe problem:When I log out of the Workspace or if I close the Workspace window, the Workdocs drive on W: unmounts itselfI know because I have file backup software that backs up files to an external host. The software fails with a "path not found" error when it runs while I'm not logged in. But it runs successfully when I am logged in. No other changes.I'm not looking to be convinced to back up to S3, I have y reasons for backing up using a 3rd party back up toolI just want to answer the question "how can I keep the workdocs drive mounted to my windows 2016 Workspace, even when I'm no logged into the Workspace"ThanksFollowComment"

Answer: "0That is not the default behavior, I recommend opening a support case so they can analyze the logs to determine why this is happening.CommentShareEXPERTStevieStetsanswered 3 months ago"


Question: [Cloudfront] Are there security implications to the ALL_VIEWER origin request policy?

What is the scenario where you wouldn't want to use the ALL_VIEWER managed origin request policy? Are there any security implications to using that for all distributions (S3 origins and ALB origins)?https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.htmlFollowComment

Answer: "0Accepted AnswerThe ALL_VIEWER origin request policy will forward all headers, cookies and query strings to requests that reach the origin but caching will not defined based on the headers, cookies and query strings being forwarded.In terms of best practices, you should only forward the exact headers, cookies or query strings which your application needsCommentShareSUPPORT ENGINEERDavin_Ganswered a year agovasco a month agoI don't think you really answered the question here; Like why is this is best practise? Does it have any security implications for example? Perhaps based on those best practises?Sharevasco a month agoFor example my assumption would be that it in general makes sense to include all headers because;As you pointed out, cloudfront doesn't use all of them for caching, so no adverse effects thereThe origin will mostly likely only parse the headers it needs to functionLastly, in terms of logging request from your server to debug failed request or even detect malicious requests, it would be more helpfull to have more headers as you have more information from the request made.I am probably wrong as you pointed out it's better to only select the ones needed, so I would live to know why!Share"


Question: Make deployments work ( with codeploy )

Need helpI just installed codeploy on an Ubuntu EC2 instance and armed a pipeline on bitbucket to trigger deployments. My deployments fail on the first events (ApplicationStop and DownloadBundle).Errors found in codedeploy-agent.aws_wire.log[Aws::CodeDeployCommand::Client XXXXXXXXXX 0 retries] poll_host_command(host_identifier:"arn:aws:ec2:eu-west-3:XXXXXXXXXXXX:instance/i-ffffffffffffffff") Aws::CodeDeployCommand::Errors::AccessDeniedExceptionFollowComment

Answer: "0Hello,I see there is an "AccessDeniedException" error in there. That can be for a few different reasons. I would recommend checking the following:Ensure the EC2 you are trying to deploy to has an IAM Role attached with a Policy that allows access to/from Codedeploy.Ensure the instance you are trying to connect to is in the same region/account as CodeDeploy. If not, add necessary IAM permissions to the Role attached to the EC2.Ensure the Security Group(s) associate with your EC2 instance allows the needed traffic from CodeDeploy. you can also use VPC Flowlogs to see the traffic flow and see if it is beeing blocked somewhere.If you are using subnet NACLs, ensure they are allowing the appropriate ports/traffic from CodeDeploy as well.Let me know if this helps!CommentShareCloud_Ganswered 5 months ago0This looks like an issue with the IAM instance profile attached to the Ec2 instance (if there is any IAM role attached). Attach an IAM role to the ec2 instance if not already done, and give it required permissions.CommentShareRishianswered 5 months ago0Hi guys..it is without issue. I tried everything but still got the error message.There is an IAM role attached to the EC2 instance and the IAM Policy Simulator show that any https request from this role to CodeDeploy or CodeDeploy secure host command are allowedits the same with the user goup assoiated with the aws credentials. The IAM Policy Simulator show that this user is allowed to access  CodeDeploy or CodeDeploy secure host commandEc2 instance and S3 are in the same region/account eu--west-3here are the permissions grantedEC2 instance Role:AutoScalingFullAccessAmazonEC2RoleforAWSCodeDeployAmazonS3FullAccessAWSCodeDeployFullAccessCodeDeploy Commands SecureUser GroupAutoScalingFullAccessAmazonS3FullAccessAWSCodeDeployFullAccessCodeDeploy Commands SecureCodeDeploy Service roleAutoScalingFullAccessAmazonS3FullAccessAWSCodeDeployFullAccessAWSCodeDeployRoleS3 security strategyPublic access: disbled{    "Statement": [        {            "Action": [                "s3:Get*",                "s3:List*","s3:PutObject"            ],            "Effect": "Allow",            "Resource": "arn:aws:s3:::storagename/*",            "Principal": {                "AWS": [                    "arn:aws:iam::XXXXXXXXXX:role/ec2_role_name"                ]            }        }    ]}ERROR MSGstarting SSL for codedeploy-commands-secure.eu-west-3.amazonaws.com:443...SSL established, protocol: TLSv1.2, cipher: XXXXX-RSA-XXXX-GCM-SHA256<- "POST / HTTP/1.1\r\nContent-Type: application/x-amz-json-1.1\r\nAccept-Encodiing: \r\nUser-Agent: aws-sdk-ruby3/3.109.0 ruby/3.0.2 x86_64-linux-gnu aws-sdk-coodedeploycommand/1.0.0\r\nX-Amz-Target: CodeDeployCommandService.PollHostCommand\\r\nX-Amz-Codedeploy-Agent-Version: OFFICIAL_1.3.2-1902_deb\r\nHost: codedeploy-ccommands-secure.eu-west-3.amazonaws.com\r\nX-Amz-Date: 20221222T161902Z\r\nX-Amz--Content-Sha256: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\r\nAuthorization: AWS4-HMAC-SHA256 Credential=XXXXXXXXXXXXXXXXXXX/20221222/eu--west-3/codedeploy-commands-secure/aws4_request, SignedHeaders=content-type;host;;x-amz-codedeploy-agent-version;x-amz-content-sha256;x-amz-date;x-amz-target, Siggnature=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\r\nConteent-Length: 84\r\nAccept: */*\r\n\r\n"-> "HTTP/1.1 400 Bad Request\r\n"-> "x-amzn-RequestId: xxxxxx-xxxxxx-xxxxx-xxxxx-xxxxxxxxxxxxxxxxxxxxx\r\n"-> "Date: Thu, 22 Dec 2022 16:19:02 GMT\r\n"-> "Content-Type: application/x-amz-json-1.1\r\n"-> "Content-Length: 34\r\n"-> "\r\n"reading 34 bytes...-> ""-> "{\"__type\":\"AccessDeniedException\"}"read 34 bytesConn keep-aliveCommentSharerePost-User-8496999answered 5 months ago"