Question: npm publish for a package to AWS CodeArtifact repo fails with error "The provided package is configured to block new version publishes."

"I've created an AWS CodeArtifact repository with an upstream connection to npmjs.com. After installing the latest publicly available version of the lodash package (4.17.21), I tried to publish a self-patched version to the repository (4.17.50). When I do this, I get the following error:npm ERR! 400 Bad Request - PUT https://amazon-{redacted}.d.codeartifact.us-west-2.amazonaws.com/npm/test-repository/lodash - The provided package is configured to block new version publishes.The provided package is configured to block new version publishesWhat would cause this action to be blocked? Similar publishes have succeeded in the past, has something recently changed?FollowComment"

Answer: "0CodeArtifact recently released a feature called Package Origin Control (POC) to help avoid unintended intermixing of public (such as from npmjs.com) and private package versions.This feature lets repository owners block how new versions of a package get sourced into a repository by blocking publication of new versions and/or downloading upstream versions into the repository. This can help users protect against a “dependency substitution” attack where a package version for a package that is intended to be internal-only is published to a public repository by a malicious actor to trick the build systems to unintentionally consume the malicious external version instead. Blog post on the topic: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610.Each package in a CodeArtifact repository now has two origin control flags publish, and upstream. Each can be set to either ALLOW or BLOCK. The publish flag controls whether new versions of the package can be published into the repository, and the upstream flag controls whether new versions of the package present in an upstream repository but not yet retained in the repository will be available through the upstream repository.If a package first enters a repository as a result of being downloaded from an upstream, then the package has its publish flag set to BLOCK. This is what has happened to the package in question. If you wish to intentionally mix public and private packages, then you will need to set the publish flag for the package to ALLOW. You can do this in the AWS Console on the CodeArtifact package details page (Repositories list -> Repository view -> Package view -> Origin controls section), or via the AWS CLI by calling put-package-origin-configuration like so:aws codeartifact put-package-origin-configuration --domain test-domain    --repository test-repository --format npm --package lodash    --restrictions publish=ALLOW,upstream=BLOCKNote: As written, this command will allow the publish to succeed, but will prevent pulling additional public versions of lodash into the repository from npmjs.com. While the restrictions can be set to publish=ALLOW,upstream=ALLOW, the safest configuration will always have the public/upstream flags inverted to prevent mixing public and private versions. The restrictions can also be set temporarily in the event you want to publish a patched version of a public package, then return to blocking future publishes.CommentSharepotockibanswered a year ago"


Question: How to get "client-less" traces in X-Ray's service map

"Hi,I've been trying to make a bit more sense of my X-Ray traces, and I've been seeing a lot of stuff that is initated by my service (like initialisation calls or stuff done in an update loop) being seen by X-ray as having a client request behind them.Traces are sent from a go program with the otel go SDK to an OTEL collector which then forwards them to the AWS account.I've tried intialising the trace with different traceKind (Internal, Producer) to no avail.I was able to get what I wanted using the aws client to send out edited traces with an invalid 'parent_id' parameter to get the visualisation I wanted in the ServiceMap, but this is pretty hacky & I couldn't even get the same result through OTEL's go sdk.(The service in the example is actually run locally for testing, I just forced the origin to AppRunner so the serviceMap doesn't get confused & so I do not confuse them with actual ECS instances of the services that are running)For the sake of example, here's a trace with an "unwanted client", and the manually edited version which appears "clientless" in the service map:The version with the client link{    "Id": "1-63ee407a-35043ec3121f735baa80ebea",    "Duration": 0.801,    "LimitExceeded": false,    "Segments": [        {            "Id": "497e0cc431330383",            "Document": {                "id": "497e0cc431330383",                "name": "SQS",                "start_time": 1676481266.4775069,                "trace_id": "1-63ee407a-35043ec3121f735baa80ebea",                "end_time": 1676481267.278352,                "fault": false,                "error": false,                "throttle": false,                "aws": {                    "queue_url": "https://sqs.eu-west-1.amazonaws.com/639648953767/rt-netsample-ServicesStack-VpcDev-snsrtnetsampledevonlinebmatchmaki-rRQaezXx98aB",                    "xray": {                        "auto_instrumentation": false                    },                    "region": "eu-west-1",                    "operation": "SendMessageBatch",                    "request_id": "618bb528-1ab6-5fe3-8fc0-e94f0f854783"                },                "metadata": {                    "default": {                        "messaging.system": "AmazonSQS",                        "messaging.url": "https://sqs.eu-west-1.amazonaws.com/639648953767/rt-netsample-ServicesStack-VpcDev-snsrtnetsampledevonlinebmatchmaki-rRQaezXx98aB",                        "aws.service": "SQS",                        "otel.resource.cloud.platform": "aws_app_runner",                        "otel.resource.cloud.provider": "aws"                    }                },                "origin": "AWS::AppRunner::Service"            }        }    ]}The version without:{    "Id": "1-63ee41c9-a06f9285771aedcd36b04dd3",    "Duration": 0.801,    "LimitExceeded": false,    "Segments": [        {            "Id": "497e0cc431330383",            "Document": {                "id": "497e0cc431330383",                "name": "SQS",                "start_time": 1676481266.4775069,                "trace_id": "1-63ee41c9-a06f9285771aedcd36b04dd3",                "end_time": 1676481267.278352,                "parent_id": "004f72be19cddc2b",                "fault": false,                "error": false,                "throttle": false,                "aws": {                    "queue_url": "https://sqs.eu-west-1.amazonaws.com/639648953767/rt-netsample-ServicesStack-VpcDev-snsrtnetsampledevonlinebmatchmaki-rRQaezXx98aB",                    "xray": {                        "auto_instrumentation": false                    },                    "region": "eu-west-1",                    "operation": "SendMessageBatch",                    "request_id": "618bb528-1ab6-5fe3-8fc0-e94f0f854783"                },                "metadata": {                    "default": {                        "messaging.system": "AmazonSQS",                        "messaging.url": "https://sqs.eu-west-1.amazonaws.com/639648953767/rt-netsample-ServicesStack-VpcDev-snsrtnetsampledevonlinebmatchmaki-rRQaezXx98aB",                        "aws.service": "SQS",                        "otel.resource.cloud.platform": "aws_app_runner",                        "otel.resource.cloud.provider": "aws"                    }                },                "origin": "AWS::AppRunner::Service"            }        }    ]}Thanks in advance !FollowComment"


Question: Data Reduction Technologies in AWS

"Team,I wanted to know if you have any data reduction technologies like compression, Dedup, etc available as a part of the EBS/EFS/S3 Storage options?Or Does the customer need to use any 3rd party SW from the marketplace to do this?FollowComment"

Answer: "0HelloIf you are using Amazon FSx Netapp ONTAP for block or file needs, you can enable Compression & Deduplication on a per volume basis. What is your use case and what type of Storage are you looking to use?More info about Amazon FSx Netapp ONTAPhttps://docs.aws.amazon.com/fsx/latest/ONTAPGuide/what-is-fsx-ontap.htmlCommentSharerePostfanclubanswered a year agorePost-User-3858667 a year agoI am looking to understand what technology AWS has for block storage.Share"


Question: Unable to query the shared database received from the lakeformation as an admin user(awsuser) in the redshift cluster.

"Hi , Im trying on the new feature Amazon redshift datashares via Lake formation, using blog as a reference  , but at the consumer side is it possible to query the database as an admin user , instead of creating an IAM users and later delegating permissions to them to query the database.As I'm trying to query the database as an admin user(awsuser in my case) Im getting an error as "no session credential found code:8001". Any solution how to resolve this error ?FollowComment"


Question: "Very urgent, Certification first name change"

I contacted the AWS Training and Certification Customer Support yesterday to change my first name to include a middle name that I never use but they haven't done so yet and have not contacted me through my email.I know that this is very late but if anyone at AWS support could help me get my first name changed then I would be extremely gratefulEdit: The exam proctor did not care about the miss-match between my passport's first name containing my middle name and the first name in my certification not containing my middle nameFollowComment

Answer: "0Please submit a ticket to the AWS Training & Certification customer support team, and they will provide assistance. If you already submitted a case, please allow at least 48 hrs to get a response.CommentShareNelliT-AWSanswered 2 months ago"


Question: CodeBuild artifact upload to S3 root

"Hi,I have a CodeBuild config that almost meets our requirements, except for a tiny detail.We need the artifacts to be uploaded to the S3 bucket root, not within a folder.The default behavior to place artifacts in a folder with the same name as the build seems very strong. I have managed to override that by using the 'name' attribute within 'artifacts' but I have found no way to set name to empty string. When doingname: ''the attribute is disregarded.Is there any way to make CodeBuild upload artifacts to the S3 bucket root?Thanks,Thomas Å.FollowComment"

Answer: "0Hi takesson,If you put a . in the name section of the artifacts it will place the artifacts in the root of the s3 bucket.Let me know if you have any other questions,JohnCommentShareAWS-User-8407687answered 4 years ago0Hi John,I thought I had triedname: .orname: '.'obviously not because it works fine.The web console does not fully understand . because the link to S3 includes a . prefix. Not a big deal.Many thanks for your help,Thomas Å.CommentSharetakessonanswered 4 years ago0Hi,I'm having the same problem, but in my case the contents are being wrapped in a folder "site/".I'm not sure where this folder is defined, and I've tried everything but it keeps putting the artifacts in that folder.Any help will be appreciated!Thanks,AmyEDIT: I solved it by setting both fields in the artefacts config (path, and name) as "."Edited by: amypellegrini on Feb 11, 2021 1:25 AMCommentShareamypellegrinianswered 2 years ago"


Question: How to fix "java.lang.NoClassDefFoundError: org/apache/commons/cli/ParseException"

"I'm following the instructions on https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.DownloadingAndRunning.htmlI downloaded DynamoDBLocal. I then tried to run this command and I get this error. I assume that maybe I need to pass in the commons-cli path to java, but the -jar would take precedence. So what do I do?$ java -Djava.library.path=./DynamoDBLocal_lib -jar DynamoDBLocal.jar -sharedDbError: Unable to initialize main class com.amazonaws.services.dynamodbv2.local.main.ServerRunnerCaused by: java.lang.NoClassDefFoundError: org/apache/commons/cli/ParseException```FollowComment"


Question: OpenSearch Serverless complete deletion

"I was experimenting with OpenSearch serverless service and I can't completely delete the service now that I'm not using it. I deleted all the domains, collections, policies,  etc and I'm still being charged for the service.Capacity management is still set to 2 instances but it can't be reduced to 0 or completely delete the service.I'm being charged for the service even though I'm not using it.Any help on how to shut down this service would be helpful because it is eating my budget.FollowComment"

Answer: "0Hello,Sorry to see you're having trouble here. I found a resource that may help get this resolved: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-get-answers.html.I'd also recommend opening a case with our Billing team so they can look into it with you, and assist to provide next steps.You can open a case in our Support Center, here: http://go.aws/support-center.— Ann D.CommentShareEXPERTAWS Support - Annanswered 2 months ago"


Question: API Gateway SSL certificate for backend authentication for a Spring Boot REST API microservice

I am trying to implement the solution provided here: https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html for a Java Spring Boot based REST API. How can I go about doing that?FollowComment

Answer: "0Hi,Once you have generated a client cert in API console and configured API to use SSL certificates following the doc https://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started-client-side-ssl-authentication.html , you will have to create a truststore including the client certificate generated on API Gateway. Then, you can configure the truststore for SSL verification from API Gateway to backend.Here is a helpful article to understand the implementationhttps://dzone.com/articles/hakky54mutual-tls-1CommentShareSUPPORT ENGINEERSumit_K-Ranswered 4 months ago"


Question: SSL issues on my lightsail Wordpress site

"I renewed the ssl certificate according to the instructions here https://aws.amazon.com/premiumsupport/knowledge-center/lightsail-bitnami-renew-ssl-certificate/It was successfully renewed, yet it still has a warning that the ssl is expired whenever you visit the site www.shirleyxu.caPlease adviseFollowComment"

Answer: "0Hi,I took a look at your site, the cert doesn't seem to be valid still. Have you tried using bncert tool? : https://aws.amazon.com/premiumsupport/knowledge-center/linux-lightsail-ssl-bitnami/'sudo /opt/bitnami/bncert-tool' ?CommentShareBrian Grafanswered 10 months agorePost-User-4523864 10 months agoThanks, do I need to remove the existing certs prior to reinstalling ?SharerePost-User-4523864 10 months ago/opt/bitnami/letsencrypt /etc/letsencrypt/etc/letsencrypt/archive/shirleyxu.ca-0002/fullchain1.pem/etc/letsencrypt/archive/shirleyxu.ca-0002/cert1.pem/etc/letsencrypt/archive/www.shirleyxu.ca/fullchain1.pem/etc/letsencrypt/archive/www.shirleyxu.ca/cert1.pem/etc/letsencrypt/archive/shirleyxu.ca/cert2.pem/etc/letsencrypt/archive/shirleyxu.ca/fullchain2.pem/etc/letsencrypt/archive/shirleyxu.ca-0001/fullchain1.pem/etc/letsencrypt/archive/shirleyxu.ca-0001/cert1.pemIt got multiple ssl certificates, I think I renewed the 0001 and 0002 certs, but not the main one. Please advise on how do I remove them and starting from scratch.Share"


Question: How to access metadata of an S3 object using Aws Glue?

"I want to access a field of metadata , but I am unable to fetch the key-value pairs of S3 object metadataFollowComment"

Answer: "0You can create a crawler by starting in the Athena console and then using the AWS Glue console in an integrated way. When you create the crawler, you specify a data location in Amazon S3 to crawl.https://docs.aws.amazon.com/athena/latest/ug/data-sources-glue.htmlCommentShareAWS-User-8719617answered 8 months agoApurva 8 months agoHeyThanks for responding.But, I am still unable to access it.Share"


Question: SES SNS duplicate notification with different messageID but single email

"I've set up SNS with SES and while looking at my logs, I'm seeing duplicate entries for open events but with DIFFERENT messageids, despite only a single email. I am able to verify that it's a single email because I've tested it by sending an email to myself, but moreover, in the logs, the timestamps are almost the exact same time (off by milliseconds). The one interesting thing is the ipAddress is slight different (one ends with .211, and the other with .219)I've attached the record log below of two OPEN records from the same recipient.{'EventSource': 'aws:sns', 'EventVersion': '1.0', 'EventSubscriptionArn': 'arn:aws:sns:us-west-1:12345678765:topic_name:c765a5cf-06cf-44d8-afdc-28b63033c949', 'Sns': {'Type': 'Notification', 'MessageId': '1123745b-e254-5168-962b-2e6f2e7ac2fb', 'TopicArn': 'arn:aws:sns:us-west-1:12345678765:topic_name', 'Subject': 'Amazon SES Email Event Notification', 'Message': '{"eventType":"Open","mail":{"timestamp":"2021-12-16T03:12:53.124Z","source":"redact","sendingAccountId":"12345678765","messageId":"0111017dc13a7384-bd1cf759-6814-418c-bd29-6f981a451a2e-000000","destination":["destination@gmail.com"],"headersTruncated":false,"headers":[{"name":"Date","value":"Thu, 16 Dec 2021 03:12:53 +0000"},{"name":"From","value":"redact"},{"name":"Reply-To","value":"redact"},{"name":"To","value":"destination@gmail.com"},{"name":"Message-ID","value":"<321132367.51541.1639624373206@ip-10-0-33-160.us-west-1.compute.internal>"},{"name":"Subject","value":"subject line"},{"name":"MIME-Version","value":"1.0"},{"name":"Content-Type","value":"text/html; charset=UTF-8"},{"name":"Content-Transfer-Encoding","value":"quoted-printable"}],"commonHeaders":{"from":["redact"],"replyTo":["redact"],"date":"Thu, 16 Dec 2021 03:12:53 +0000","to":["destination@gmail.com"],"messageId":"0111017dc13a7384-bd1cf759-6814-418c-bd29-6f981a451a2e-000000","subject":"subject line"},"tags":{"ses:operation":["SendTemplatedEmail"],"ses:configuration-set":["topic_name"],"ses:source-ip":["redact"],"ses:from-domain":["b.com"],"ses:caller-identity":["caller_id"]}},"open":{"timestamp":"2021-12-16T05:09:02.500Z","userAgent":"Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko Firefox/11.0 (via ggpht.com GoogleImageProxy)","ipAddress":"0.0.0.211"}}\n', 'Timestamp': '2021-12-16T05:09:02.554Z', 'SignatureVersion': '1', 'Signature': 'e1swVjH1PFog/9syhhDOvS6BgNZnI3RN6k+fRfkXUaUXfmsiy2kAJ+ozKUi9BlnLRtCMnnxRH2GEV6w6t2C4WjWi/IBYr+YUn5veiZtAyQYG/NYgZhCM6yqvfIpfog2wPC3cc0tXj2oehZo8OXj8YvCbz3i8LR+wXn6lNewitJiYNX0yOVzCAWH6xd0QFlNULTk3RYNarM/a5ZmRXil35fhGWsDJnGWjNC5r32WXJB9eAZANpoNMiX/dbUxZTLWqolRGqC3M+JH3qjl/Cy/JSu+pWbSN/mtl/RzLD6W2fZBRtbApHTT+BoRi+x4hz/W6kl5FVUvl3NiSAiZsFQ4DoQ==', 'SigningCertUrl': 'https://sns.us-west-1.amazonaws.com/SimpleNotificationService-7ff5318490ec183fbaddaa2a969abfda.pem', 'UnsubscribeUrl': 'https://sns.us-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-1:12345678765:topic_name:c765a5cf-06cf-44d8-afdc-28b63033c949', 'MessageAttributes': {}}}{'EventSource': 'aws:sns', 'EventVersion': '1.0', 'EventSubscriptionArn': 'arn:aws:sns:us-west-1:12345678765:topic_name:c765a5cf-06cf-44d8-afdc-28b63033c949', 'Sns': {'Type': 'Notification', 'MessageId': '39179993-647d-521d-ab77-c3a7a853b700', 'TopicArn': 'arn:aws:sns:us-west-1:12345678765:topic_name', 'Subject': 'Amazon SES Email Event Notification', 'Message': '{"eventType":"Open","mail":{"timestamp":"2021-12-16T03:10:32.670Z","source":"redact","sendingAccountId":"12345678765","messageId":"0111017dc1384ede-364355c2-5014-4940-a863-a811402771c1-000000","destination":["destination@gmail.com"],"headersTruncated":false,"headers":[{"name":"Date","value":"Thu, 16 Dec 2021 03:10:32 +0000"},{"name":"From","value":"redact"},{"name":"Reply-To","value":"redact"},{"name":"To","value":"destination@gmail.com"},{"name":"Message-ID","value":"<240748958.52874.1639624232756@ip-10-0-99-60.us-west-1.compute.internal>"},{"name":"Subject","value":"subject line"},{"name":"MIME-Version","value":"1.0"},{"name":"Content-Type","value":"text/html; charset=UTF-8"},{"name":"Content-Transfer-Encoding","value":"quoted-printable"}],"commonHeaders":{"from":["redact"],"replyTo":["redact"],"date":"Thu, 16 Dec 2021 03:10:32 +0000","to":["destination@gmail.com"],"messageId":"0111017dc1384ede-364355c2-5014-4940-a863-a811402771c1-000000","subject":"subject line"},"tags":{"ses:operation":["SendTemplatedEmail"],"ses:configuration-set":["topic_name"],"ses:source-ip":["redact"],"ses:from-domain":["b.com"],"ses:caller-identity":["caller_id"]}},"open":{"timestamp":"2021-12-16T05:09:02.441Z","userAgent":"Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko Firefox/11.0 (via ggpht.com GoogleImageProxy)","ipAddress":"0.0.0.219"}}\n', 'Timestamp': '2021-12-16T05:09:02.489Z', 'SignatureVersion': '1', 'Signature': 'VUVBiM+AiCrfdjhZROCI2C3CnYiHD0fa/l8JK5adqnwTXauCZ83Ee/TFZXTXlXk9kweErI5n7ogbHDfe7nvTCjUuQ89I7WM1otU1xW7jkgxInSRTB4QrZl9FFhRUXQ5YiAlYJzhx3gB8+lD46hcQ2vGpRZ8IMPIpo7cnmryeBJxDHJg6ulQL+KWllrJVe8FHWjB5PeCxBHSl3+KWdmjVpakkF45pOpURXhuhVLtgUIP81AUM1510WtJhgKGvc1k1upUrLGHfWnsWe/qRCq+FJ4TdPvbokyGX/TahaSiBQYfgW9GhhRDWTjz5ebYdV9DZeIaJ7zPm0ep+2BYuHhYt4Q==', 'SigningCertUrl': 'https://sns.us-west-1.amazonaws.com/SimpleNotificationService-7ff5318490ec183fbaddaa2a969abfda.pem', 'UnsubscribeUrl': 'https://sns.us-west-1.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-1:12345678765:topic_name:c765a5cf-06cf-44d8-afdc-28b63033c949', 'MessageAttributes': {}}}Anyone have any clue what I'm doing wrong to cause this?FollowCommentrePost-User-9648090 6 months agoAny updates on this? i'm having exactly the same problem! one email sent to aws ses. Somehow, we're getting multiple open notifications with different message ids!Share"

Answer: "0I don't see the receipt node in the notification. receipt.recipients contains the envelope recipients (RCPT TO) for the message, which may differ from the message recipients (To:, CC: headers in the DATA). Some sending MTAs (i.e. Gmail) batch all recipients for a single domain in a single SMTP transaction (subject to an internal RCPT TO limit) and some MTAs (i.e. Yahoo) send a message for every recipient. The only way you'll know is by comparing the envelope recipients (receipt.recipients[]) with the message recipient headers (To:, CC:).See https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email-notifications-contents.html#receiving-email-notifications-contents-receipt-objectCommentSharemdibellaanswered a year ago0Can you help me, how can I check logs using message ID?Thanks!CommentShareRitik Jainanswered a month ago"


Question: TagSpecifications

Hi. I am trying to add tags when an SSM Automation script creates an AMI of an EC2 instance. How am I supposed to use the TagSpecifications input?FollowCommentAWS-Jacob 8 months agoHello.  Can you give more context for this question?  Are you using a custom document?  What step are you creating the instance with (ex: aws:executeScript)?  What API are you calling with the TagSpecifications input?Share


Question: How to run a spring cloud function as AWS lambda using custom java 17 base image? Kindly give a sample dockerfile for the same?

Java 17 is not supported by aws lambda. I need to create a lambda function using spring cloud and java 17 as base image. What dependencies i must install in my java 17 base image?FollowCommentalatech EXPERT2 months agoDoes this help? https://aws.amazon.com/blogs/compute/build-a-custom-java-runtime-for-aws-lambda/Share

Answer: "0Here are the dependencies you may need to include in your Java base image to support Spring Cloud and AWS Lambda:Java runtime environment (JRE): This should be included in your Java base image. You can use OpenJDK or Oracle JDK as the JRE.AWS Lambda Java runtime interface: This is provided by the AWS Lambda Java SDK, which you can include as a dependency in your deployment package.Spring Cloud AWS dependencies: These include the Spring Cloud AWS Core and Spring Cloud AWS Context modules, which provide integration with AWS services such as S3, DynamoDB, and SQS. You can include these dependencies in your deployment package using Maven or Gradle.Spring Boot dependencies: Depending on your use case, you may also need to include Spring Boot dependencies in your deployment package. However, since Spring Boot does not yet officially support Java 17, you may need to use an older version of Spring Boot that supports Java 16 or earlier.Here's an example Dockerfile that uses a lightweight Java 17 base image and includes the necessary dependencies:FROM adoptopenjdk:17-jre-hotspotRUN mkdir -p /opt/appWORKDIR /opt/app# Copy the deployment package into the containerCOPY target/my-lambda-function.jar /opt/app# Install the AWS Lambda Java runtime interfaceRUN curl -sL https://repo1.maven.org/maven2/com/amazonaws/aws-lambda-java-core/1.2.1/aws-lambda-java-core-1.2.1.jar -o /opt/app/aws-lambda-java-core.jar# Install the Spring Cloud AWS dependenciesRUN curl -sL https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-aws-core/2.3.2/spring-cloud-aws-core-2.3.2.jar -o /opt/app/spring-cloud-aws-core.jar && \    curl -sL https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-aws-context/2.3.2/spring-cloud-aws-context-2.3.2.jar -o /opt/app/spring-cloud-aws-context.jarCMD ["java", "-jar", "/opt/app/my-lambda-function.jar"]CommentShareEXPERTsdtslmnanswered 2 months ago"


Question: Fleet Provisioning of GGv2 devices

"Hi,I am experimenting with fleet provisioning for our GG devices. I am able to following the example of IoT Fleet provisioning to create IoT thing and thing group, with proper certs. But it is not a Greengrass core device. What do I need to do to create a Greengrass core device and properly provisioning it? Some earlier questions mentioned setting up aws-greengrass-nucleus, but it is not clear to me how that works. I cannot seem to find any documentation on this. Thanks!FollowComment"

Answer: "0For anyone interested. This seems to be problem with 32-bit Raspberry Pi OS. Once I moved to 64-bit Pi OS, the problem went away.CommentSharejcaianswered 2 years agoargandas a year agoSeems like I have the same problem... After a successful GreenGrass Fleet Provision, the device is registered in AWS IoT as a Thing (I know provisioning was successful as I can see the new certificate attached to the Thing), but is not registered as a GreenGrass Core device.I have a setup on EC2 (with TCP connection enabled) and RPi, both with the same issue, in both cases, I get these errors in /greengrass/v2/logs/greengrass.log related to MQTT:EC2 Instance:2022-06-24T05:22:27.557Z [WARN] (pool-2-thread-9) com.aws.greengrass.deployment.IotJobsHelper: No connection available during subscribing to Iot Jobs descriptions topic. Will retry in sometime. {ThingName=ec2_gg_thing_test}2022-06-24T05:22:35.268Z [ERROR] (pool-2-thread-1) com.aws.greengrass.mqttclient.MqttClient: Error subscribing. {topic=$aws/things/ec2_gg_thing_test/shadow/name/AWSManagedGreengrassV2Deployment/update/accepted}2022-06-24T05:22:35.269Z [WARN] (pool-2-thread-1) com.aws.greengrass.deployment.ShadowDeploymentListener: Caught exception while subscribing to shadow topics, will retry shortly. {}RPi Zero:2022-06-24T05:25:20.883Z [WARN] (pool-2-thread-11) com.aws.greengrass.deployment.IotJobsHelper: No connection available during subscribing to Iot Jobs descriptions topic. Will retry in sometime. {ThingName=rpiZero}2022-06-24T05:26:10.037Z [ERROR] (pool-2-thread-10) com.aws.greengrass.mqttclient.MqttClient: Error subscribing. {topic=$aws/things/rpiZero/shadow/name/AWSManagedGreengrassV2DeploymenShare0Hi jcai,Once you have the thing, thing group and certs, you would have to follow steps for manual resource provisioning here: https://docs.aws.amazon.com/greengrass/v2/developerguide/manual-installation.html . You could skip to the "Download the AWS IoT Greengrass Core software" section as you do not need IoT thing and certs to be recreated.Thanks,Navya.CommentShareNavyaKuchibhotla-AWSanswered 2 years ago0Hi Navya,Thanks for the response. I did what you suggested. But when I ran the java command with init-config file:"sudo -E java -Droot="/greengrass/v2" -Dlog.store=FILE  -jar ./GreengrassCore/lib/Greengrass.jar  --init-config ./GreengrassCore/config.yaml  --component-default-user ggc_user:ggc_group  --setup-system-service true"I don't see GG core device created. The greengrass log shows exception create new aws_tls_ctx (below).2021-05-14T19:31:24.545Z [INFO] (main) com.aws.greengrass.lifecyclemanager.Kernel: Attempt to load service from plugins. {serviceName=TelemetryAgent}2021-05-14T19:31:24.652Z [ERROR] (pool-2-thread-6) com.aws.greengrass.lifecyclemanager.KernelExceptionHandler: uncaught-exception. {thread=Thread[pool-2-thread-6,5,main]}software.amazon.awssdk.crt.CrtRuntimeException: TlsContext.tls_ctx_new: Failed to create new aws_tls_ctx (aws_last_error: AWS_IO_TLS_CTX_ERROR(1033), Failed to create tls context) UNKNOWN(-1)at software.amazon.awssdk.crt.io.TlsContext.tlsContextNew(Native Method)at software.amazon.awssdk.crt.io.TlsContext.<init>(TlsContext.java:24)at software.amazon.awssdk.crt.io.ClientTlsContext.<init>(ClientTlsContext.java:26)at software.amazon.awssdk.iot.AwsIotMqttConnectionBuilder.build(AwsIotMqttConnectionBuilder.java:418)at com.aws.greengrass.mqttclient.AwsIotMqttClient.establishConnection(AwsIotMqttClient.java:240)at com.aws.greengrass.mqttclient.AwsIotMqttClient.connect(AwsIotMqttClient.java:212)at com.aws.greengrass.mqttclient.AwsIotMqttClient.subscribe(AwsIotMqttClient.java:144)at com.aws.greengrass.mqttclient.MqttClient.subscribe(MqttClient.java:410)at com.aws.greengrass.mqttclient.WrapperMqttClientConnection.subscribe(WrapperMqttClientConnection.java:73)at software.amazon.awssdk.iot.iotshadow.IotShadowClient.SubscribeToUpdateNamedShadowAccepted(IotShadowClient.java:748)at com.aws.greengrass.deployment.ShadowDeploymentListener.subscribeToShadowTopics(ShadowDeploymentListener.java:134)at com.aws.greengrass.deployment.ShadowDeploymentListener.lambda$postInject$0(ShadowDeploymentListener.java:116)at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)at java.lang.Thread.run(Thread.java:748)2021-05-14T19:31:24.732Z [INFO] (main) com.aws.greengrass.lifecyclemanager.Kernel: service-loaded. {serviceName=TelemetryAgent}2021-05-14T19:31:24.774Z [INFO] (main) com.aws.greengrass.lifecyclemanager.Kernel: effective-config-dump-complete. {file=/greengrass/v2/config/effectiveConfig.yaml}Some additional information for you. I get the exception when I specify "thingName" in the config.yaml. If I don't specify "thingName" in the config,yaml, but specify -tn option on the command line, I don't see the exception in the log file. The command will run successfully, but I still don't see the core device on IoT console.Any idea what went wrong?  ThanksEdited by: jcai on May 14, 2021 1:37 PMCommentSharejcaianswered 2 years ago"


Question: Limit access to MWAA Public Environment UI

"I set up a public mwaa environment but i want to limit UI access to only specific IP rangeI tried to remove everything from the inbound security group that mwaa public environment is using but it is still accessible from the public internet, removing it also caused scheduler to crash but i added 5432 port and it is fixed, that is the only inbound rule that the environment hasI am probably missing sth but not sure whatIs it possible to limit access to UI ?ThanksFollowComment"

Answer: 1You may limit MWAA UI access using IAM's SourceIp condition: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_IPAddressCommentShareJohn_Janswered 6 months agojohn 6 months agoI got an error thoughPrivate IP Address: aws:SourceIp works only for public IP address ranges. The values for condition key aws:SourceIp include only private IP addresses and will not have the desired effect. Update the value to include only public IP addressesFor my private environment there is a route table addressingDestinationlets say 10.1.0.0/16Targettgw-....I want to limit my public UI access to only that private ip rangeShare


Question: Is it possible to log 'allowed' TLS and/or HTTP domain names with Network Firewall?

"AWS Network Firewall seems to easily log the domain names (via HTTP or SNI headers) of sites that are blocked.However, what if I wanted to also log domain names that are allowed?  I have tried adding an IPv4 rule with protocol 'HTTP' as well as 'TLS' with an 'alert' action; as well as a Suricata rule, such as:alert tls any any -> any any (flow:established,to_server; msg:"Log TLS domains, after establishment and protocol identification"; sid: 1000001; rev:1;)But neither causes allowed domains to get logged.  Is it possible?FollowComment"

Answer: "0It could be that you already allowed the connection in your domain while-list and therefore above rule is never triggered? By default pass'es are evaluated first, and alerts are processed last. This explains the options for rule evaluation https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.htmlYou didn't say why you want to log all the domains, but if the goal is to monitor outbound traffic, then this might be helpful https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/use-network-firewall-to-capture-the-dns-domain-names-from-the-server-name-indication-sni-for-outbound-traffic.htmlCommentShareKalluanswered 4 months agorePost-User-3531463 4 months agoThanks for responding.  Indeed, the 'action order' is the reason the Suricata rule doesn't get hit, because by that point the traffic was already allowed.We want to log Internet traffic from the environment in question, mainly for potential troubleshooting purposes -- it would be much easier to find a certain HTTP(S) session in a sea of logs when you can just search for the FQDN, rather than trying to hunt it down by IP address, especially if the IP resolved at the time of attempt isn't the same as what it resolves to in the moment.The doc you shared is helpful but I think will only be effective if you are allowing all outbound HTTP(S) traffic, because you would be falling off the bottom of the policy and Suricata's default action is to 'pass' if no rule matches.  (As I understand it, at least.)  So if we wanted to only allow connections to certain domains (using a domain list rule), and block everything else, I think I would still run into the first problem of the policy scan never reaching an 'alert' rule where the Host/SNI would be written to the logs.  If you could both pass and alert in the same rule, like with a typical firewall, that would work -- but does not seem possible here.Please let me know if you can think of any other permutation that might solve this; thanks!ShareKallu 4 months agoAccording to docs you should be able to both alert and pass, but in 2 different rules.After all rules have been evaluated, handle the packet according to the the action setting in the first rule that matched the packet. If the first rule has a drop action, block the packet. If it has an alert action, continue evaluation.https://docs.aws.amazon.com/network-firewall/latest/developerguide/rule-action.htmlShare"


Question: HPA in EKS based on number of active connections

"I want to use Websockets from FastAPI for my pod to be deployed in EKS.Now my idea is to keep the number of active websocket connections rather constant. I thought of using the Prometheus-Adapter for it.However, I am rather inexperienced in setting things up. Do you have suggestions or perhaps even an example?FollowComment"

Answer: "0Yes, you can use the Prometheus-Adapter to autoscale your EKS pods based on the number of active websocket connections.Here is an example of how you can set it up:First, you need to deploy the Prometheus-Adapter in your EKS cluster. You can use the following command to deploy it:kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/prometheus-adapter/master/deploy/manifests/prometheus-adapter.yamlNext, you need to create a Custom Metrics API server. You can use the following YAML configuration to create a Custom Metrics API server:apiVersion: v1kind: ServiceAccountmetadata:  name: custom-metrics  namespace: kube-system---kind: ClusterRoleapiVersion: rbac.authorization.k8s.io/v1metadata:  name: custom-metricsrules:- apiGroups: ["custom.metrics.k8s.io"]  resources: ["*"]  verbs: ["*"]---kind: ClusterRoleBindingapiVersion: rbac.authorization.k8s.io/v1metadata:  name: custom-metricssubjects:- kind: ServiceAccount  name: custom-metrics  namespace: kube-systemroleRef:  kind: ClusterRole  name: custom-metrics  apiGroup: rbac.authorization.k8s.io---apiVersion: apps/v1kind: Deploymentmetadata:  name: custom-metrics  namespace: kube-system  labels:    k8s-app: custom-metricsspec:  replicas: 1  selector:    matchLabels:      k8s-app: custom-metrics  template:    metadata:      labels:        k8s-app: custom-metrics    spec:      serviceAccountName: custom-metrics      containers:      - image: k8s.gcr.io/custom-metrics-stackdriver-adapter:v0.10.0        name: custom-metrics-adapter        args:        - --source=stackdriver        - --stackdriver.metrics-prefix=custom.googleapis.com/        - --config=/etc/config/config.yaml        volumeMounts:        - name: config-volume          mountPath: /etc/config      volumes:      - name: config-volume        configMap:          name: custom-metrics-configCreate a configuration file for the Prometheus-Adapter. Here is an example configuration file that retrieves the number of active websocket connections:apiVersion: v1kind: ConfigMapmetadata:  name: prometheus-adapter-config  namespace: kube-systemdata:  metrics:    - seriesQuery: 'websocket_connections{job="your-app"}'      resources:        overrides:          resource: 'pod'      name:        matches: "websocket_connections"        as: "websocket_connections"      metricsQuery: 'max_over_time({{{.Series}}}[5m])'Finally, you can create a Horizontal Pod Autoscaler (HPA) using the following command:kubectl autoscale deployment your-app --cpu-percent=50 --min=1 --max=10 --name=your-app-hpaThis HPA will scale up or down based on the number of active websocket connections.You can also use the **kubectl get hpa **command to check the status of the HPA and see how many replicas are currently running.I hope this helps! Let me know if you have any questions.CommentSharehashanswered a month ago"


Question: my "token-signature" in aws iot test-invoke-authorizer always mismatch

"I had try to use AWS IoT Core Authorizer with AWS Lamda Function follow this guide.https://docs.aws.amazon.com/iot/latest/developerguide/config-custom-auth.htmland thishttps://docs.aws.amazon.com/iot/latest/developerguide/custom-auth-tutorial.htmlI can create Lamda Function and Authorizer like that guide.But I had always got this Error :"An error occurred (InvalidRequestException) when calling the TestInvokeAuthorizer operation: Token signature mismatch for authorizer my-new-authorizer1"when I try to test it by test-invoke-authorizer.I guess I maybe do some mistake on key-generate or signature-generate by OpenSSL.So I try to validate them for check the compatible of them and It's compatible.And now, I have no idea what I do mistake.Does anyone suggest me what should I doThank You for your time.FollowComment"

Answer: "0Accepted AnswerOK, it was solved.after meeting with AWS technical support and he show me how to create the key.That's about OpenSSL key generator which the OpenSSL are not regular support Windows OS.So it's very complicate to generate the key from windows.And the other thing is version of OpenSSL which document recommend to 1.1.1i.I had try to use OpenSSL 1.1.1i from Ubuntu OS with same procedure in that document and it's work fine without error.So let's change your OS to solve it.Thank You everyoneCommentSharerePost-User-1457441answered 4 months ago0Thanks for reaching out. Can you please confirm if on the tutorial you have done steps 1-3 successfully? i.e lambda add permission with no errors?Yes, it's. I can do it without any error.For step 4, have you ensured that this is generated with the "tokenKeyValue" and same is used for testing the authorizer ?Yes, I had generate it by OpenSSL V1.1.1 but I had also try with OpenSSL V3 too and it was the same error."Copy this signature string to use in the next step. Be careful not to include any extra characters or leave any out."I had check it by debug mode of "TestInvokeAuthorizer" and I didn't see any extra charactor in it.Another thing that I feel some strange. it's a private-key generator in https://docs.aws.amazon.com/iot/latest/developerguide/custom-auth-tutorial.html"openssl genrsa -out private-key.pem 4096"I saw some document is use 2048 length but I think it should not matter to check matching of both key.and even 2048 length, it had mismatch too.Thank You for your time.CommentSharerePost-User-1457441answered 8 months agoAWS-User-Nitin EXPERT8 months agoThanks for your response. I re-ran the tutorial end to end and it works well without issues . Openssl version does not matter.4096 is the size of the private key to generate in bits. This must be the last option specified. The default is 2048I think if you can confirm that below stepsecho -n "tokenKeyValue" | openssl dgst -sha256 -sign private-key.pem | openssl base64 -Aand thenaws iot test-invoke-authorizer --authorizer-name my-new-authorizer --token tokenKeyValue \ --> this should be same as when you used echo -n "tokenKeyValue"  above--token-signature <<signature above not to include any extra characters or leave any out.>>Any changes in the --token or --token-signature may not let it validate.Another idea is that follow Step 5: Test publishing MQTT message using PostmanShare0Hello,Have you been able to solve this issue?I am also following this tutorial from top to bottom  https://docs.aws.amazon.com/iot/latest/developerguide/custom-auth-tutorial.html but I am getting the following error every time (Postman is also not working):An error occurred (InvalidRequestException) when calling the TestInvokeAuthorizer operation: Token signature mismatch for authorizer my-new-authorizerAlso in step 3, the Lambda permission statement shown in the tutorial is:{    "Statement": "{\"Sid\":\"Id-1234\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"iot.amazonaws.com\"},\"Action\":\"lambda:InvokeFunction\",\"Resource\":\"arn:aws:lambda:Region:57EXAMPLE833:function:custom-auth-function\",\"Condition\":{\"ArnLike\":{\"AWS:SourceArn\":\"arn:aws:lambda:Region:57EXAMPLE833:function:custom-auth-function\"}}}"}But the previous step to create the permission through the CLI indicates:aws lambda add-permission  \--function-name "custom-auth-function" \--principal "iot.amazonaws.com" \--action "lambda:InvokeFunction" \--statement-id "Id-1234" \--source-arn authorizerArnTo use the authorizerArn as the "source-ARN" but the statement is using the lambda function ARN, which one is correct? I test both but still getting the "Token signature mismatch..." error.Any assistance would be greatly appreciated.Regards.GianpieroCommentSharecompanyglueanswered 5 months agorePost-User-1457441 4 months agoI have some meeting with technical of aws tomorrow. so if you have some question about this please list it to me.if it's possible I maybe ask them too.Thank You.Share0Thanks for reaching out. Can you please confirm if on the tutorial you have done steps 1-3 successfully? i.e lambda add permission with no errors?For step 4, have you ensured that this is generated with the  "tokenKeyValue" and same is used for testing the authorizer ?echo -n "tokenKeyValue" | openssl dgst -sha256 -sign private-key.pem | openssl base64 -AAlso in step 4, can you confirm that this check is done ? "Copy this signature string to use in the next step. Be careful not to include any extra characters or leave any out."CommentShareEXPERTAWS-User-Nitinanswered 8 months ago0"Another idea is that follow Step 5: Test publishing MQTT message using Postman"after your suggestion.I had try to do follow in step 5.and I saw first wrong thing that it's my policy was deny this request.I 'm unsure that it had relation with mismatch between public key and signature, isn't it.and if I can resolve that policy (which I had do it before), I will update later.Thank You for your advice.CommentSharerePost-User-1457441answered 8 months ago0Have you been able to solve this issue?No, I'm still being stuck at the same situation.andTo use the authorizerArn as the "source-ARN" but the statement is using the lambda function ARN, which one is correct?I had use arn from authorizerArn in response of create authorizerCommentSharerePost-User-1457441answered 4 months ago"


Question: Desktop Browser (Device Farm) Ip ranges

"Hi,I'm looking for the IP ranges of the Desktop Browser service from Device Farm.I have currently added the following ranges to my VPN:100.20.244.103/3244.225.225.32/3244.227.49.133/32But some sessions have an IP outside these ones.Could I get an updated IP ranges for the Desktop Browser service?Thank you and have a nice day,DavideFollowComment"


Question: Why AWS and SES team is so non-friendly?

"I'm new user in AWS. I have website and want to send newsletters. I've found, that Amazon SES have good pricing and I wish to migrate. BUTwhen I send request for production access, because from sandbox you can only test, I really don't know, WHO can work under sandbox.So, I sent my request by first time and result is deny in 2 seconds, than I send another one reply to this case, and result deny in few hours.I've done all steps from SES Docs, I verified domain and clearly described my process. I prefer to make some complaints on AWS and SES service, I will contact first with AWS sales, than I will contact with other services and I will share my AWS experience on reddit, quora, Facebook and many other social.My case id xxxxxxxxxx*Edit: Removed case ID — Kita B.FollowComment"

Answer: "0Hello Inge,I'm so sorry for any frustration caused by the outcome of your SES sending quota request. All new accounts are placed in the Amazon SES sandbox, from which you're able to use all of our Amazon SES features. However, certain restrictions are your applied to your account.Requests to remove your account from the sandbox are carefully reviewed by our Support team, however, they might not be granted if your use case does not align with our policies.For more information on moving out of the Amazon SES sandbox, please review the following documentation:https://docs.aws.amazon.com/ses/latest/dg/request-production-access.htmlVisit the following link for details on qualifying for automatically and user-requested increased SES sending quotas:https://docs.aws.amazon.com/ses/latest/dg/manage-sending-quotas-request-increase.htmlFor security reasons, we're unable to discuss case or account details on this platform. If you have any questions or concerns, please reopen your support case. You may also provide feedback on your case in our Support Center:http://go.aws/support-centerBest regards,Kita B.CommentShareEXPERTAWS Support - Kitaanswered a year agoInge Brinkmann a year agoDear, Kita. My SES usage and content of website fully comply with policies of AWS. If you don't indicate in policies, terms and other resources - its not issue customers, its AMAZON issue.Share0Good luck. Horrible support from AWS sadly. We are struggling so much still shows domain verification pending although we have 20+ Linux experience and doing websites for 15+ years. DKIM records aren't even checked by Amazon it seems. Stuck for a few days now. Guess they don't want our business.CommentShareCindyanswered 9 months ago"


Question: HTTP 1xx codes causes environment to be incorrectly classified as unhealthy

"Hi,We believe that HTTP 1xx return codes (in our case 101 for websockets) are being counted by the enhanced health monitoring.When a large enough count of these 101 codes are returned by the server, it decreases the overall 2xx percentage. When the 2xx percentage drops below a certain level, Elastic Beanstalk marks the environment as degraded.We are constantly finding our environment marked as degraded due to this reason.Is it possible not to have the 1xx codes counted in the health check?FollowComment"

Answer: "0Update:We ended up modifying our nginx configuration to not log the 101's in the healthd logs (we currently use Amazon Linux 1 and nginx).Essentially what we did was change /etc/nginx/conf.d/healthd_http.conf from:log_format healthd  '$msec"$uri"''$status"$request_time"$upstream_response_time"''$http_x_forwarded_for';To:map $status $logflag {101 0;default 1;}log_format healthd  '$msec"$uri"''$status"$request_time"$upstream_response_time"''$http_x_forwarded_for';And change /etc/nginx/conf.d/elasticbeanstalk/healthd.conf from:if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})T(\d{2})") {set $year $1;set $month $2;set $day $3;set $hour $4;}access_log /var/log/nginx/healthd/application.log.$year-$month-$day-$hour healthd;To:if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})T(\d{2})") {set $year $1;set $month $2;set $day $3;set $hour $4;}access_log /var/log/nginx/healthd/application.log.$year-$month-$day-$hour healthd if=$logflag;To achieve this, we used the .ebextensions/ method. i.e:We created the folders in the root of our package .ebextensions/nginx/conf.d/ and .ebextensions/nginx/conf.d/elasticbeanstalk/In the .ebextensions/nginx/conf.d/ folder we created the healthd_http.conf file (.ebextensions/nginx/conf.d/healthd_http.conf) and added the contents:map $status $logflag {101 0;default 1;}log_format healthd  '$msec"$uri"''$status"$request_time"$upstream_response_time"''$http_x_forwarded_for';And in the .ebextensions/nginx/conf.d/elasticbeanstalk/ folder we created the healthd.conf file (.ebextensions/nginx/conf.d/elasticbeanstalk/healthd.conf) and added the contents:if ($time_iso8601 ~ "^(\d{4})-(\d{2})-(\d{2})T(\d{2})") {set $year $1;set $month $2;set $day $3;set $hour $4;}access_log /var/log/nginx/healthd/application.log.$year-$month-$day-$hour healthd if=$logflag;And once deployed, the alerts stopped for us.We adapted the solution from a "Programmer All" article - we couldn't find the author's name, but thanks to them! Their solution is for Amazon Linux 2, so if you want that one google with the quotes "Health status of Elastic Beanstalk changed to 'Serve' due to the http code 101" and it should be the first result.CommentShareAtavismanswered 2 years ago"


Question: Whay am I being purchased in free tier? My AWS Academy 100$ credit is being consumed

"As a proyect from my educative institution, I've received a 100$ credit in AWS Academy, and we're using AWS for launching EC2 instance, specifically EC2 t2.micro Ubuntu 22.04 LTS, which is applicable for free tier. However, during the weeks my 100$ credit has being consumed (I have launched 3 intances of the same type). I checked the Cost Explorer section and efectively i have been purchased for ec2 resources. I know that the free tier offers 750 hrs/month free. But even so with my 3 insctances running, I haven't aws all the days of the week, so I'm unconcerned with my bill. My currect bill is 16$ of the 100$ credit, and the all time i've been used AWS is one mont and half, but as I mentioned, I didn't used AWS all the days of the week and all hours of the day. So I would like to knwo why I am being purchased.In addition to all that I mentioned, as soon as I lunched my first instance, my credit has been consumed too (1 o 2 dolar in a week)FollowComment"

Answer: "2Accepted AnswerTo my understanding the computer free tier of 750 hours per month would account for the usage of one EC2-Instance in always-on state. If you had three EC2-Instances in an always-on state then this would be over 2,000 compute hours per-month which you would pay the hours above the free tier level.You also have EC2-Other charges which are mostly data transfer, EBS volumes and Snapshots and these are not normally free.I recommend using the Instance scheduler, turning the instances off when not in use, or consider removing the other two EC2-Instances.CommentShareDavidanswered 17 days agoSamuel Cano 16 days agoThank you David for your answer. Perhaps I read it, but didn't notice that the instance is in an always-on state, that makes much sense since the bill has increased with the second instance I launched, and much more with the third one. Thank  you very much.Share1You can find out more details by going into the Billing Dashboard and selecting Bills from the panel on the left, then about halfway down you'll see the Charges By Service tab which lists all the chargeable items that you've run in the current billing period.I guess you're going to have a non-zero amount against Elastic Compute Cloud, so you can expand that section and find out exactly what it is you're being billed for, and additionally this is sorted by region.Does this shed more light on where the charges have come from?CommentShareRWCanswered 17 days agoSamuel Cano 16 days agoEffectively RWC, now it's all more clear and that explains why my EC2-Other charges are greater than EC2-intances charges, because of volume. I'll be more careful with this. Thank for your valuable information.Share"


Question: ASP.NET Authentication not working for newer ELB environments.

"Hello, we have been experiencing a problem with an Android application of ours that works as a client for an ELB ASP.NET application. Our application uses ASP.NET authentication (sessions are stored in SQL Server, "ASPStateTempSessions" table) and works as expected when using any regular browser (Chrome, Firefox): one cookie session becomes a single table record.In our Android app instead, we get an "expired session" error every time. We have noticed that one single login attempt results in around ten table records at SQL Server, our guess is that cookies are somehow being rejected and a new ASP.NET_SessionId cookie is generated each time (the id's at the database shows it's so). The login process is fairly simple: Android sends a couple of HTTP/Ajax requests to the ASP.NET application, which in turns authenticates against a database and returns an ASP.NET session.Now the thing is that this was working perfectly, and still is for older ELB environments. Each time we clone an old environment we can't get authentication to work. We've notice that, despite the new environment was cloned, Windows versions differ:old working environment, created 6 months ago, EC2 windows server 2016 version is build 14393.3204new non-working cloned environment, created 2 months ago, EC2 windows server 2016 version is build 14393.3504note: the Windows Updates installed for each environment are also differentWe believe it could a problem with cookies and Windows patches as seen herehttps://stackoverflow.com/questions/59427488/patch-iis-kb4533011-december-2019-aws-elb-sticky-problemWe have tried everything we could think of, we set/unset the 'SameSite' attribute, tweaked Load Balancer's parameters, used HTTP instead of HTTPS, recompiled our Android app, but the login procedure does not work in the new environment, when we switch to the old one, works as a charm.We will investigate if there's some upgrade to the Cordova tools, but still, what could make the new ELB environment fail, especially considering the old one works fine?FollowComment"

Answer: "0Hello, we found the answer ourselves, luckily. It seems that ElasticBeansTalk/IIS is setting the "SameSecure=Lax" attribute automatically for all session cookies. So it seems that "ASP.NET_SessionId" has this new attribute and WebView-Cordova cannot handle it. Older EBS/IIS versions do not behave this way.The solution was to disable the samesite attribute at the "void Session_Start(object sender, EventArgs e)" procedure when Android is being used, as seen here:https://techcommunity.microsoft.com/t5/iis-support-blog/samesite-in-code-for-your-asp-net-applications/ba-p/1156361Hope this helps someone else.CommentShareSoporteAddentraanswered 3 years ago"


Question: AWS unhealthy target group instances

"I am working on an AWS project at Udacity and deploying an infrastrucute with elastic load balancer, auto scaling group, listeners, listener rules, security groups and target groups. My problem is that the health check status of the instances in the target group always result in unhealthy instances and therefore I am not able to call the load balancer DNS url nor the ip of the instances. I always have 502 bad gateway. What I doing wrong. Here is my code:Description: >  xxx / Udacity 2023Parameters:  EnvironmentName:    Description: An environment name that will be prefixed to resource names    Type: String  myLaunchTemplateVersionNumber:    Type: String    Default: 1Resources:  LBSecGroup:    Type: AWS::EC2::SecurityGroup    Properties:      GroupDescription: Allow http to our load balancer      VpcId:         Fn::ImportValue:          !Sub "${EnvironmentName}-VPCID"      SecurityGroupIngress:       - IpProtocol: tcp        FromPort: 80        ToPort: 80        CidrIp: 0.0.0.0/0       SecurityGroupEgress: security group.      - IpProtocol: tcp        FromPort: 80        ToPort: 80        CidrIp: 0.0.0.0/0  WebServerSecGroup:    Type: AWS::EC2::SecurityGroup    Properties:      GroupDescription: Allow http to our hosts and SSH from local only      VpcId:        Fn::ImportValue:          !Sub "${EnvironmentName}-VPCID"      SecurityGroupIngress:      - IpProtocol: tcp        FromPort: 8080        ToPort: 8080        CidrIp: 0.0.0.0/0      - IpProtocol: tcp         FromPort: 22        ToPort: 22        CidrIp: 0.0.0.0/0      SecurityGroupEgress:      - IpProtocol: tcp        FromPort: 0        ToPort: 65535 #end port        CidrIp: 0.0.0.0/0  myWebAppLaunchTemplate:    Type: AWS::EC2::LaunchTemplate    Properties:      LaunchTemplateData:        UserData:          Fn::Base64: !Sub |            #!/bin/bash            apt-get update -y            apt-get install apache2 -y            systemctl start apache2.service            cd /var/www/html            echo "Udacity Demo Web Server Up and Running!" > index.html        ImageId: ami-0a261c0e5f51090b1         KeyName: mykey         SecurityGroupIds:              - sg-01ad772aba0f98d98  # then note the security group id from AWS console todo: use web server SecurityGroup ID        InstanceType: t3.medium # Amazon nomenclature for a specific machine which is how much RAM and which CPU        # Specifying here that we need 10 GB hard drive for this machine and one drive is enough        BlockDeviceMappings:          - DeviceName: "/dev/sdk" # where do I put the hard drive, mount point where you can create folders            Ebs:              VolumeSize: '10' # how much Hard-drive space this machine going to need  WebAppGroup:    Type: AWS::AutoScaling::AutoScalingGroup    Properties:      VPCZoneIdentifier:        - Fn::ImportValue: !Sub "${EnvironmentName}-PUB-NETS"      LaunchTemplate:        LaunchTemplateId: !Ref myWebAppLaunchTemplate # mandantory        Version: !Ref myLaunchTemplateVersionNumber # mandantory      MinSize: "3"      MaxSize: "5"      TargetGroupARNs:       - Ref: WebAppTargetGroup   WebAppLB:      Type: AWS::ElasticLoadBalancingV2::LoadBalancer     Properties:      Subnets:       - Fn::ImportValue: !Sub "${EnvironmentName}-PUB1-SN"      - Fn::ImportValue: !Sub "${EnvironmentName}-PUB2-SN"      SecurityGroups:      - Ref: LBSecGroup  Listener:     Type: AWS::ElasticLoadBalancingV2::Listener    Properties:      DefaultActions:      - Type: forward        TargetGroupArn:          Ref: WebAppTargetGroup      LoadBalancerArn:        Ref: WebAppLB      Port: '80'       Protocol: HTTP  ALBListenerRule:    Type: AWS::ElasticLoadBalancingV2::ListenerRule    Properties:      Actions:      - Type: forward # forward requests to the specified target group        TargetGroupArn: !Ref 'WebAppTargetGroup'      Conditions:      - Field: path-pattern        Values: [/]       ListenerArn: !Ref 'Listener'      Priority: 1  WebAppTargetGroup:    Type: AWS::ElasticLoadBalancingV2::TargetGroup    Properties:       HealthCheckIntervalSeconds: 30       HealthCheckPath: /       HealthCheckProtocol: HTTP       HealthCheckTimeoutSeconds: 15      HealthyThresholdCount: 2       UnhealthyThresholdCount: 5       Port: 8080       Protocol: HTTP      VpcId: # in which VPC the resource is created        Fn::ImportValue:          Fn::Sub: "${EnvironmentName}-VPCID"Before creation of above infrastructure I need to create the stack below:Parameters:    EnvironmentName:        Description: An environment name that will be prefixed to resource names        Type: String    VpcCIDR:        Description: Please enter the IP range (CIDR notatio) for this VPC        Type: String        Default: 10.0.0.0/16    PublicSubnet1CIDR:        Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability Zone        Type: String        Default: 10.0.0.0/24    PublicSubnet2CIDR:        Description: Please enter the IP range (CIDR notation) for the public subnet in the second Availability Zone        Type: String        Default: 10.0.1.0/24    PrivateSubnet1CIDR:        Description: Please enter the IP range (CIDR notation) for the private subnet in the first Availability Zone        Type: String        Default: 10.0.2.0/24    PrivateSubnet2CIDR:        Description: Please enter the IP range (CIDR notation) for the private subnet in the second Availability Zone        Type: String        Default: 10.0.3.0/24Resources:    VPC:        Type: AWS::EC2::VPC        Properties:            CidrBlock: !Ref VpcCIDR            EnableDnsHostnames: true            Tags:                - Key: Name                  Value: !Ref EnvironmentName    InternetGateway:        Type: AWS::EC2::InternetGateway        Properties:            Tags:                - Key: Name                  Value: !Ref EnvironmentName    InternetGatewayAttachment:        Type: AWS::EC2::VPCGatewayAttachment        Properties:            InternetGatewayId: !Ref InternetGateway            VpcId: !Ref VPC # referencing to the VPC created earlier    # Create 2 public subnets each in AZ0 and AZ1, except for the changed value in the field MapPublicIpOnLaunch: true.    # Marking this field as True will enable the Auto-assign public IP address field of the public subnet    PublicSubnet1:        Type: AWS::EC2::Subnet        Properties:            VpcId: !Ref VPC # referencing to the VPC created earlier            AvailabilityZone: !Select [0, !GetAZs ""]            CidrBlock: !Ref PublicSubnet1CIDR # referencing to PublicSubnet1CIDR parameter            MapPublicIpOnLaunch: true # do the subnet gets automatically an IP address            Tags: # Name your subnets using tags, to keep track when you create many subnets.                - Key: Name                  Value: !Sub ${EnvironmentName} Public Subnet (AZ1)    PublicSubnet2:        Type: AWS::EC2::Subnet        Properties:            VpcId: !Ref VPC # referencing to the VPC created earlier            AvailabilityZone: !Select [1, !GetAZs ""]            CidrBlock: !Ref PublicSubnet2CIDR # referencing to PublicSubnet2CIDR parameter            MapPublicIpOnLaunch: true            Tags:                - Key: Name                  Value: !Sub ${EnvironmentName} Public Subnet (AZ2)    PrivateSubnet1:        Type: AWS::EC2::Subnet        Properties:            VpcId: !Ref VPC # referencing to the VPC created earlier            AvailabilityZone: !Select [0, !GetAZs ""] # Notice that our private subnets are not sharing availability zones.            # We are keeping them separated as we displayed in our diagrams from the previous lesson.            # To do so, the !GetAZs‘’ function fetches the list of AZs in your region which are indexed 0, 1, etc.            # Then, the !select [0, !GetAZs‘’] returns only the first AZ.            CidrBlock: !Ref PrivateSubnet1CIDR # referencing to PrivateSubnet1CIDR parameter            MapPublicIpOnLaunch: false            Tags:                - Key: Name                  Value: !Sub ${EnvironmentName} Private Subnet (AZ1)    PrivateSubnet2:        Type: AWS::EC2::Subnet        Properties:            VpcId: !Ref VPC # referencing to the VPC created earlier            AvailabilityZone: !Select [1, !GetAZs ""] # the!Select [ 0, !GetAZs '' ] is returning the first AZ from the list of all AZs in your region.            # Similarly, for PrivateSubnet2, the !Select [ 1, !GetAZs '' ] will return the second AZ.            CidrBlock: !Ref PrivateSubnet2CIDR # referencing to PrivateSubnet2CIDR parameter            MapPublicIpOnLaunch: false            Tags:                - Key: NameAW                  Value: !Sub ${EnvironmentName} Private Subnet (AZ2)# The EIP in AWS::EC2::EIP stands for Elastic IP. # This will give us a known/constant IP address to use instead of a disposable or ever-changing IP address. # This is important when you have applications that depend on a particular IP address    NatGateway1EIP:        Type: AWS::EC2::EIP        DependsOn: InternetGatewayAttachment        Properties:            Domain: vpc# Use the DependsOn attribute to protect your dependencies from being created without the proper requirements. # In the scenario above the EIP allocation will only happen after the InternetGatewayAttachment has completed    NatGateway2EIP:        Type: AWS::EC2::EIP        DependsOn: InternetGatewayAttachment        Properties:            Domain: vpc    NatGateway1:        Type: AWS::EC2::NatGateway        Properties:            AllocationId: !GetAtt NatGateway1EIP.AllocationId            SubnetId: !Ref PublicSubnet1    NatGateway2:        Type: AWS::EC2::NatGateway        Properties:            AllocationId: !GetAtt NatGateway2EIP.AllocationId            SubnetId: !Ref PublicSubnet2    PublicRouteTable:        Type: AWS::EC2::RouteTable        Properties:             VpcId: !Ref VPC            Tags:                 - Key: Name                   Value: !Sub ${EnvironmentName} Public Routes    DefaultPublicRoute:         Type: AWS::EC2::Route        DependsOn: InternetGatewayAttachment # not neccessary, depends on an InternetGatewayAttachment properly working.         # only used when InternetGateway is attached to VPC and not in any other time during the creation of these resources        Properties:             RouteTableId: !Ref PublicRouteTable            DestinationCidrBlock: 0.0.0.0/0 # rule means: if you're routing traffic to any address (0.0.0.0 is wildcard address or all addresses),             #  they will be routed to this particular resource in GatewayId InternetGateway            # 0.0.0.0 means just send traffic to InternetGateway            # destination matching and a wildcard address (0.0.0/0) to reference all traffic.            # when we use the wildcard address 0.0.0.0/0, we are saying for any address that is destined for any IP address in the world,             # send it to the referenced GatewayId            GatewayId: !Ref InternetGateway#VPC have route table with routes but could have multiple subnets. SubnetRouteTableAssociation associates a rules to subnets     PublicSubnet1RouteTableAssociation:        Type: AWS::EC2::SubnetRouteTableAssociation        Properties:            RouteTableId: !Ref PublicRouteTable            SubnetId: !Ref PublicSubnet1    PublicSubnet2RouteTableAssociation:        Type: AWS::EC2::SubnetRouteTableAssociation        Properties:            RouteTableId: !Ref PublicRouteTable            SubnetId: !Ref PublicSubnet2        PrivateRouteTable1:        Type: AWS::EC2::RouteTable        Properties:             VpcId: !Ref VPC            Tags:                 - Key: Name                   Value: !Sub ${EnvironmentName} Private Routes (AZ1)    # route DefaultPrivateRoute1 is attached to the PrivateRouteTable1 and is routed via NatGateway1    # routing traffic to wildcard address 0.0.0.0/0 then send this traffic to NatGateway1, don't exit to the outside    # keep traffic for private subnets within VPC    DefaultPrivateRoute1:        Type: AWS::EC2::Route        Properties:            RouteTableId: !Ref PrivateRouteTable1            DestinationCidrBlock: 0.0.0.0/0            NatGatewayId: !Ref NatGateway1    # servers within private subnet don't have IP Address    # even placing them on a public subnet, there is no way to access them if they have no IP address    # associate PrivateSubnet1 with rule DefaultPrivateRoute1 from route table PrivateRouteTable1    PrivateSubnet1RouteTableAssociation:        Type: AWS::EC2::SubnetRouteTableAssociation        Properties:            RouteTableId: !Ref PrivateRouteTable1            SubnetId: !Ref PrivateSubnet1    PrivateRouteTable2:        Type: AWS::EC2::RouteTable        Properties:             VpcId: !Ref VPC            Tags:                 - Key: Name                   Value: !Sub ${EnvironmentName} Private Routes (AZ2)    DefaultPrivateRoute2:        Type: AWS::EC2::Route        Properties:            RouteTableId: !Ref PrivateRouteTable2            DestinationCidrBlock: 0.0.0.0/0            NatGatewayId: !Ref NatGateway2    PrivateSubnet2RouteTableAssociation:        Type: AWS::EC2::SubnetRouteTableAssociation        Properties:            RouteTableId: !Ref PrivateRouteTable2            SubnetId: !Ref PrivateSubnet2Outputs:# use this resources in other scripts or files#  we are returning the id of our VPC as well as our Environment's Name:    VPC:        Description: A reference to the created VPC        Value: !Ref VPC # referencing to the VPC created earlier        Export:            Name: !Sub ${EnvironmentName}-VPCID # Substitution of EnvironmentName from parameter     PublicSubnets:        Description: A list of the public subnets        Value: !Join [",", [!Ref PublicSubnet1, !Ref PublicSubnet2]]  # join means put several strings together        Export:            Name: !Sub ${EnvironmentName}-PUB-NETS            # Ref get ID of  PublicSubnet1 and PublicSubnet2    PrivateSubnets:        Description: A list of the private subnets        Value: !Join [",", [!Ref PrivateSubnet1, !Ref PrivateSubnet2]]        Export:            Name: !Sub ${EnvironmentName}-PRIV-NETS    PublicSubnet1:        Description: A reference to the public subnet in the 1st Availability Zone        Value: !Ref PublicSubnet1        Export:            Name: !Sub ${EnvironmentName}-PUB1-SN    PublicSubnet2:        Description: A reference to the public subnet in the 2nd Availability Zone        Value: !Ref PublicSubnet2        Export:            Name: !Sub ${EnvironmentName}-PUB2-SN    PrivateSubnet1:        Description: A reference to the private subnet in the 1st AvailabilityFollowCommentShahad_C a month agoBreak down the troubleshooting into chunks to eliminate possibilities.  Start by logging into the instance and seeing if the webserver is running.  Can you 'curl localhost' inside the instance and get a reply?  If no, its an issue with the userdata script; if yes, its config external to the instanceShare"

Answer: "1Accepted AnswerIt does not look like you are configuring Apache to listen to port 8080.#!/bin/bashyum update -yyum install -y httpdsed -i 's/Listen 80/Listen 8080/' /etc/httpd/conf/httpd.confsystemctl start httpdsystemctl enable httpdCommentShareEXPERTkentradanswered a month ago0@Shahad_C do you mean curl host into private instance ? What I tried is to ssh login via a bastion host aka jump box to the private instances but I always get a permission denied. I will try to curl localhost too. The instructor in Udacity also uses the following script which I will use in user data in my next try:#!/bin/bashInstall dockerapt-get updateapt-get install -y apt-transport-https ca-certificates curl software-properties-commoncurl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -add-apt-repository \"deb [arch=amd64] https://download.docker.com/linux/ubuntu \$(lsb_release -cs) \stable"apt-get updateapt-get install -y docker-ceusermod -aG docker ubuntudocker run -p 8080:8080 tomcat:8.0CommentShareugurkocak1980answered a month agoShahad_C a month agoYes, if its a private instance you'd need to login to it via a Bastion.  The bastion would need to have your SSH KeyPair uploaded to it for you to be able to SSH into the private instance.  Once inside the private instance you would be able to check if Apache is running and accessible, as well a what port its listening onShare0thank you for your reply @kentrad. I have the same behaviour when I use the following script in UserData:     #!/bin/bash      yum update -y      yum install -y httpd      systemctl start httpd      sudo systemctl enable httpdHow can I configure Apache3 to listen on port 8080 in my UserrData script ?CommentShareugurkocak1980answered a month ago"


Question: SageMaker TensorFlow Object Detection: Null annotations raises exception

"Hi there, nice to meet you all,I've been trying to train an Object Detection Model (using Built-in Algoritms, Tensorflow) following the jumpstart examples as template, but as soon as I provide a null annotation sagemaker fails to train when calling fit(), and throws the following error (at the end of the post is the entire stacktrace)ValueError: Invalid dimensions for box data: (0,)As I understand, according to the mentioned example the annotations.json should have a COCO structure-like in order to Sagemaker considers it has valid, quoting the same tutorial:The annotations.json file should have information for bounding_boxes and their class labels. It should have a dictionary with keys "images" and "annotations". Value for the "images" key should be a list of entries, one for each image of the form {"file_name": image_name, "height": height, "width": width, "id": image_id}. Value of the 'annotations' key should be a list of entries, one for each bounding box of the form {"image_id": image_id, "bbox": [xmin, ymin, xmax, ymax], "category_id": bbox_label}.That is, as far as I know the COCO format (it should be explicitly mentioned i think!)Great!, So what the issue here?If I provide a dataset with equal n° of images and annotations, thats great and I can train sucessfully my model, but if I have an image with no object in it, then i will have more images than annotations, for instance:0001.jpeg 1 has object and the corresponding annotation0002.jpeg has no object, so it doest have an annotationSo the annotation.json file looks like:{   "images": [     {       "file_name": "0001.jpeg",       "height": 1944,       "width": 2592,       "id": "0001"     },     {       "file_name": "0002.jpeg",       "height": 1944,       "width": 2592,       "id": "0002"     }   ],   "annotations": [     {       "image_id": "0001",       "bbox": [         688,         371,         1859,         1581       ],       "category_id": 0     }   ] }As far as i could investigate, this is the standrad proccedure when no object is available, I've also downloaded an entire annotation coco dataset 2017 to make sure of this (you can download "2017 Train/Val annotations [241MB]" and search of instances_val2017.json and look for files with ID 25593, 41488, 42888 ... and you'll see that there are the images ones, but not the annotations ones)So, I would like gently ask for your help, so I can properly train my model!Thanks in advance!P.S:TraceBack[Epoch 0], Speed: 0.058 samples/sec, loss=431737.90625.Traceback (most recent call last):  File "/opt/ml/code/transfer_learning.py", line 246, in <module>run_with_args(args)  File "/opt/ml/code/transfer_learning.py", line 201, in run_with_argstrain_and_save_model(  File "/opt/ml/code/train.py", line 130, in train_and_save_modelvalidation_losses = run_validation(detection_model, validation_data, batch_size, image_size, epoch)  File "/opt/ml/code/validation.py", line 25, in run_validation    losses_dict = model.loss(prediction_dict, shapes)  File "/opt/ml/code/object_detection/meta_architectures/ssd_meta_arch.py", line 824, in loss) = self._assign_targets(  File "/opt/ml/code/object_detection/meta_architectures/ssd_meta_arch.py", line 1013, in _assign_targetsgroundtruth_boxlists = [box_list.BoxList(boxes) for boxes in groundtruth_boxes_list]  File "/opt/ml/code/object_detection/meta_architectures/ssd_meta_arch.py", line 1013, in <listcomp>groundtruth_boxlists = [box_list.BoxList(boxes) for boxes in groundtruth_boxes_list]  File "/opt/ml/code/object_detection/core/box_list.py", line 55, in __init__raise ValueError("Invalid dimensions for box data: {}".format(boxes.shape))ValueError: Invalid dimensions for box data: (0,)2023-03-09 21:59:57,046 sagemaker-training-toolkit INFO     Waiting for the process to finish and give a return code.2023-03-09 21:59:57,047 sagemaker-training-toolkit INFO     Done waiting for a return code. Received 1 from exiting process.2023-03-09 21:59:57,048 sagemaker-training-toolkit ERROR    Reporting training FAILURE2023-03-09 21:59:57,048 sagemaker-training-toolkit ERROR    ExecuteUserScriptError:ExitCode 1ErrorMessage "raise ValueError("Invalid dimensions for box data: {}".format(boxes.shape)) ValueError: Invalid dimensions for box data: (0,)"Command "/usr/local/bin/python3.9 transfer_learning.py --batch_size 5 --beta_1 0.9 --beta_2 0.999 --early_stopping False --early_stopping_min_delta 0.0 --early_stopping_patience 5 --epochs 10 --epsilon 1e-07 --initial_accumulator_value 0.1 --learning_rate 0.001 --momentum 0.9 --optimizer adam --reinitialize_top_layer Auto --rho 0.95 --train_only_top_layer False"2023-03-09 21:59:57,048 sagemaker-training-toolkit ERROR    Encountered exit_code 12023-03-09 22:00:14 Uploading - Uploading generated training model2023-03-09 22:00:20 Failed - Training job failed-----------------------------------------------------------------------------------------------------------------------------------------------------------UnexpectedStatusException                 Traceback (most recent call last)Cell In[19], line 3      1 #with load_run(experiment_name=demo_experiment.experiment_name, run_name=demo_trial.trial_name) as run:      2     #run.log_parameter("param1", "value1")----> 3 od_estimator.fit(      4         {"training": train_path},      5         # {"training": train_path, "validation": validation_path}},       6         logs=True,       7         job_name=training_job_name,       8         experiment_config = {      9             # "ExperimentName"     10             "TrialName" : demo_trial.trial_name,     11             "TrialComponentDisplayName" : "TrainingJob",     12     })File /opt/conda/lib/python3.8/site-packages/sagemaker/workflow/pipeline_context.py:272, in runnable_by_pipeline.<locals>.wrapper(*args, **kwargs)    268         return context    270     return _StepArguments(retrieve_caller_name(self_instance), run_func, *args, **kwargs)--> 272 return run_func(*args, **kwargs)File /opt/conda/lib/python3.8/site-packages/sagemaker/estimator.py:1163, in EstimatorBase.fit(self, inputs, wait, logs, job_name, experiment_config)   1161 self.jobs.append(self.latest_training_job)   1162 if wait:-> 1163     self.latest_training_job.wait(logs=logs)File /opt/conda/lib/python3.8/site-packages/sagemaker/estimator.py:2311, in _TrainingJob.wait(self, logs)   2309 # If logs are requested, call logs_for_jobs.   2310 if logs != "None":-> 2311     self.sagemaker_session.logs_for_job(self.job_name, wait=True, log_type=logs)   2312 else:   2313     self.sagemaker_session.wait_for_job(self.job_name)File /opt/conda/lib/python3.8/site-packages/sagemaker/session.py:4176, in Session.logs_for_job(self, job_name, wait, poll, log_type)   4173             last_profiler_rule_statuses = profiler_rule_statuses   4175 if wait:-> 4176     self._check_job_status(job_name, description, "TrainingJobStatus")   4177     if dot:   4178         print()File /opt/conda/lib/python3.8/site-packages/sagemaker/session.py:3707, in Session._check_job_status(self, job, desc, status_key_name)   3701 if "CapacityError" in str(reason):   3702     raise exceptions.CapacityError(   3703         message=message,   3704         allowed_statuses=["Completed", "Stopped"],   3705         actual_status=status,   3706     )-> 3707 raise exceptions.UnexpectedStatusException(   3708     message=message,   3709     allowed_statuses=["Completed", "Stopped"],   3710     actual_status=status,   3711 )UnexpectedStatusException: Error for Training job TrainNullAnnotations-tensorflow-od1-ssd-2023-03-09-21-48-59-470: Failed. Reason: AlgorithmError: ExecuteUserScriptError:ExitCode 1ErrorMessage "raise ValueError("Invalid dimensions for box data: {}".format(boxes.shape)) ValueError: Invalid dimensions for box data: (0,)"Command "/usr/local/bin/python3.9 transfer_learning.py --batch_size 5 --beta_1 0.9 --beta_2 0.999 --early_stopping False --early_stopping_min_delta 0.0 --early_stopping_patience 5 --epochs 10 --epsilon 1e-07 --initial_accumulator_value 0.1 --learning_rate 0.001 --momentum 0.9 --optimizer adam --reinitialize_top_layer Auto --rho 0.95 --train_only_top_layer False", exit code: 1FollowComment"


Question: Upgrading EC2 instances in bulk

I have 5000 EC2 instances in a AWS Account and looking for best practices to upgrade EC2 instances in bulk.FollowComment

Answer: "1Accepted AnswerUpgrading a large number of EC2 instances (e.g., 2000+) requires a well-thought-out plan, including monitoring, rollback mechanisms, and minimizing downtime.Use AWS Systems Manager: Utilize AWS Systems Manager to automate the upgrade process across multiple instances. With Systems Manager, you can create custom documents or use pre-built AWS-provided documents to run commands, stop instances, modify instance types, and start instances. You can target instances based on tags, making it easier to manage a large number of instances.With a large number of instances, it's crucial to divide the upgrade process into smaller phases or batches. This approach minimizes the impact on your applications and allows you to monitor the upgrade process more effectively. Use Auto Scaling Groups: If your instances are part of Auto Scaling Groups (ASGs), you can update the Launch Configuration or Launch Template with the new instance type, then gradually replace instances by terminating them or updating the desired capacity. ASGs will launch new instances with the updated configuration while maintaining the desired capacity.Implement a blue/green deployment strategy: Consider creating a new environment (the "green" environment) with the upgraded instances, while keeping the current environment (the "blue" environment) active. Gradually shift traffic to the new environment using a load balancer, and closely monitor the performance and stability. If any issues occur, you can quickly revert to the old environment.Monitor the upgrade process: Keep an eye on the progress of your upgrade by monitoring the instances using Amazon CloudWatch and other monitoring tools. Set up alarms to notify you in case of any issues or performance degradations.CommentShareRam_AWSanswered 2 months agoEXPERTalatechreviewed 2 months agoEXPERTBrettski-AWSreviewed 2 months ago"


Question: "Cloud HSM: How to auto sync keys, users, policies between two separate HSM clusters (within region or outside region)"

"I have a high performance requirement for the data encryption. Within a single region, we would like to set up a two HSM clusters each with more than 10 HSMs. But all HSMs has to have all same keys, users and policies. I am aware about cross-region data replication through AWS backup to replicate HSMs data but let me know if there is any other good approach to replicate HSMs data across multiple clusters. These clusters can be set up within the same region or outside region.FollowComment"

Answer: "3Like most AWS resources, clusters and HSMs are regional resources. To create HSMs in multiple Regions, you must first create a cluster in each Region. You cannot reuse or extend a cluster across Regions.https://docs.aws.amazon.com/cloudhsm/latest/userguide/regions.htmlA good approach to replicate HSMs data across multiple clusters will be to clone an AWS CloudHSM cluster across regions following the steps listed here: https://aws.amazon.com/blogs/security/how-to-clone-an-aws-cloudhsm-cluster-across-regions/CommentSharerePost-User-5076019answered 7 months ago"


Question: In AWS do VMs in placement group get built in different availability zone

In AWS we have a requirement to build VMs with terraform and increase the count of VMs if the utilisation increases. I have couple of questions in regards to this:If we place VMs in same placement group then does it ensure that they are built in different availability zones in the region (as we only want them to be in our local region). Or is there a better way of ensuring this so that I don't have to specify Availability zone for each VM manually in Terraform code and yet achieve equal distribution of VMs in availability zones?How can i use the "count" feature in terraform to increase the count of these VMs? I have created backup vault and monitoring with cloudwatch. I also need to ensure that each subsequent VM that gets added is automatically added to these as well.FollowComment

Answer: "0It's unclear how you are scaling your farm, but it appears you are relying on Terraform for that scaling. I would suggest that you use auto scaling groups instead. You can specify which AZs (via subnets) you spin up instances within: https://docs.aws.amazon.com/autoscaling/ec2/userguide/asg-in-vpc.html It is part of the service to keep the subnets balanced.A placement group is to place instances physically close together for lowest latency between the instances. This is commonly used for HPC, Map Reduce, and other cluster compute applications. These are located within an Availability Zone: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.htmlCommentShareRodney Lesteranswered a year ago"


Question: Problem with providing right "sts:RoleSessionName" while assuming IAM role using another assumed role access keys (role-chaining scenario)

"Hi,Im trying to do the role-chaining, but with proper audit of user access, to make it more "individualistic".I found this article - https://aws.amazon.com/blogs/security/easily-control-naming-individual-iam-role-sessions/ , it describes how to create an IAM policy, that will enforce user to provide its own username as sts:RoleSessionName, and it is working for assuming an IAM role using IAM users access keys.But if i have the same policy, and im trying to assume an IAM Role using another IAM role session access keys, what should be provided as sts:RoleSessionName in this case? I have tried to provide the username of the IAM user that have assumed the first Role, i have tried to provide the name of the first IAM role using which user is trying to assume second IAM role, but no luck.ThanksFollowCommentD G 13 days ago@Joann Babak did my answer work for you ? Let me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)Share"

Answer: "0If I am reading this correctly, you should be able to set the role session name to whatever you want it to be (providing that you haven't built conditionals within the trust.Try using whatever you want, also I am a big fan of using AWSume which makes setting role chaining easier IMHO. Give it a try. Getting your trust and policy statements to work are essential so that as you assume one role to the next the role assumed is included as being "ok" to assume another.CommentShareD Ganswered a month agoJoann Babak 8 days agoThe problem is that, if i attach policy (which can be found on the link i have shared in the question) to the role "A" im not able to provide everything in the "session name" (and i dont want it to be like that), so im trying to understand what it expects in this case. Im trying to force user to provide its username as session name for trailing purposes, and the policy works in case of IAM user - IAM role connection, but not in the IAM role - IAM role. Thought i havent looked into the AWSume, will do, thanks.Share"


Question: EC2 Instance gone away

"Hello,I try to stop and restart 1 of my instance. But after that, my Instance has gone away.I don't know how to find it. I really don't want to loose data on it.Could some one know why and have solution?Thanks so much,FollowComment"

Answer: "3Hi!A couple things to try:If you are in console - check to see if you are in the same region you were previously.  Sometimes when logging in, AWS will log you into a different region.  This is typically in the top right corner (N. Virginia is us-east-1 for example).Check if your EC2 console is filtering on "instance state = running."  You can remove this filter and search for all states.  For more information about states, check out this page for instance lifecycle information: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-lifecycle.html.  Keep in mind you cannot stop a instance store-backed instance.Lastly, there is a difference between termination and stopping: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.htmlIf you're using CLI or AWS APIs, you can use the ec2 describe instances command: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.htmlCommentSharejsoncanswered a year ago0Thank you,I checked with Global view also but it seem only one Instance left.I've just stopped the instance (Not terminate).Where did I go wrong?CommentShareAWS-User-1842543answered a year ago0Hello,You may want to go and check Cloudtrail using your Instance ID to see the latest APIs executed, if the Instance was indeed terminated, you can see what event and IAM Role which triggered the event.https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-api-calls/I hope that helps.CommentShareSUPPORT ENGINEERJosueAWSanswered a year ago"


Question: Only allow a role to pass itself

"I am trying to write a permission boundary policy that allows developers to create personal IAM roles that are only allowed to pass themselves to EC2 instances.I'm not seeing an obvious way to write a general purpose policy for thisI tried interpolating the role ARN in the resource field, which didn't work because the field only allows using policy variables in the final segment of the ARN.{    "Effect": "Allow",    "Action": "iam:PassRole",    "Resource": "${aws:PrincipalArn}"}There doesn't seem to be a way to either retrieve the role name for use in the resource field, or the target role ARN for use in a condition statement.ThanksP.S. I realize I could create a set of policies that each hardcode the name of the role, but I am hoping to write just a single more flexible policy because I want to use it as a permissions boundary.FollowComment"

Answer: "1You may want to look at the following KB article and borrow some methods from it. - How can I use permissions boundaries to limit the scope of IAM users and roles, and also prevent privilege escalation?CommentShareMKanswered 6 months agoEXPERTBrettski-AWSreviewed 6 months agorePost-User-1202417 6 months agoThank you, but this article does not answer my specific question.ShareBrettski-AWS EXPERT6 months agoAnd yet it is a the correct answer. In your question you say "I am hoping to write just a single more flexible policy" but you cannot (as you have discovered) put a variable name in the condition statement.Share"


Question: request signature calculated doesn't match signature provided

"I have an Ubuntu 16.04 T3.small instance running and tried adding a cloudwatch alarm to the instance from the AWS console. After the request spun for about 2 minutes, which caused Apache running on the same server to become unresponsive; cloudwatch ultimately failed to add the alert and reported the following error:"The request signature we calculated does not match the signature you provided".This is particularly vexing since I made the request from the console, NOT the API. Does anyone know what this error implies specifically in terms of an issue with the instance?More importantly, I wanted to stop the instance and re-size it. If I do this from the console, will stopping / restarting fail since the "signature" is not being calculated properly? I have a backup AMI, but if the primary AMI is failing on the cloudwatch console request, and could fail on other console functions, my guess is the backup won't work either.Any insight into the issue, and what it implies when using other console commands would be much appreciated.Thanks-AviFollowCommentA-Shevchenko a year agoIt's not very clear what are you trying to do. You're trying to add cloudwatch alarm for EC2 instance from AWS Console, right? But what about Apache, not clear why you mentioned it. Is it running on that instance?ShareAWSguy a year agoHey A-ShevchenkoThanks for answering. I was trying to add a cloudwatch alarm for CPU overage to my instance from the cloudwatch console page. After configuring what I wanted and clicking "add alarm", the console UI "spun" for about 2 minutes, and as a side note, apache that was running on the instance in question became unresponsive; eventually, the alarm failed to set, and the above error was returned.My real question is what does that error actually mean, and will other console functions like stopping / restarting the instance fail due to the same issue.thanksShare"

Answer: "0Hello,I see that you are encountering the error "The request signature we calculated does not match the signature you provided." This kind of error typically comes from an error in the canonicalization of the request, the incorrect derivation or use of the signing key, or a validation failure of signature-specific parameters sent along with the request. In this case, it would be suggested to check your AWS Secret Access Key and signing method.https://docs.aws.amazon.com/general/latest/gr/signature-v4-troubleshooting.htmlIf the signature sent in your request and the one calculated by AWS do not match, the API request will be denied. This applies to requests to start/stop your instances.https://docs.aws.amazon.com/general/latest/gr/signature-version-4.htmlHowever, since you mentioned that you used the console and not an API call, you might want to try another solution. Actually, there have been previous reports of this issue when attempting to create a CloudWatch Alarm and it was resolved by logging out of the AWS Console session and logging back in.Since re:Post is a public platform, it is not recommended to discuss signatures in detail due to security and privacy reasons. To further troubleshoot your issue, feel free to reach out to us via a support case to facilitate a discussion on the specifics of your resources.https://support.console.aws.amazon.com/support/home#/CommentShareNuzhat_Sanswered 10 months agoSUPPORT ENGINEERAWS_SamMreviewed 10 months ago"


Question: cfnRoute property for adding route to CloudWAN corenetwork target

I am unable to locate a cfnRoute property for adding a route to a CloudWAN corenetwork target. Is this feature supported?FollowComment

Answer: "0I also checked the CloudFormation documentation and could not find it.So it is possible that it is not yet supported.CommentShareEXPERTRiku_Kobayashianswered a month ago0See this issue in the CloudFormation Public Roadmap - https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1384.  If this is what you're after, then please vote on the issue.  As per the roadmap ReadMe:We strongly encourage you to vote on issues, as it helps us understand which issues will have the widest impact, but please don't leave comments saying "+1". Such comments generate noise for people receiving notifications, and issues can't be sorted by number of "+1" comments. Instead, leave a 👍 reaction, which is less noisy and can be used to sort issues for prioritization. To leave a reaction, navigate to the issue details page and add a reaction with the 😀 button on the post. There are six types of reactions supported (thumbs down "-1", confused, heart, watching, laugh, hooray, and thumbs up +1). We can typically do 8-10 items per month with all necessary regression testing, and we want you to help us decide which items will benefit you the most.If what you're after is something different not covered by an existing issue then create one.As it says in the above issue, it "can be worked around with a custom resource".  I find that writing Lambda-backed custom resources in Python using crhelper is very quick.This API page is related - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRoute.html.CommentShareEXPERTskinsmananswered a month ago"


Question: CPU Usage 100% on T3 one instance

HiI am running one instance and CPU usage max out at 100% for this instance (T3 xlarge)How do I increase the CPU capacity on a flexible basis so that the app does not keep crashing?Many Thanks in advanceFollowComment

Answer: "0With a single EC2 instance for your application, it is not possible to upgrade/downgrade the instance type without stopping it.You can consider autoscaling group and a load balancer for HA, which will help you to balance the load among your EC2 instances.CommentShareChandra Y Manswered a month agoEXPERTkentradreviewed a month ago"


Question: Process for Retake of Revoked AWS Exam.

"Hi,This is so unfortunate even after passing my AWS exam, it has been revoked without providing any information about the anomalies found. An simple email from AWS and shattered my all the hard work.In the email, it has been stating that i can retake my exam but only at the Test Center - so just wanted to know,  do i need to repay the exam fee? how long can it be booked? and what is the procedure for this?Thanks!FollowComment"

Answer: "0No, you don't have to repay the Exam Fee, please refer Sanctions section under General PoliciesFor more help, please contact Training & Certification Team - http://go.aws/contact-trainingCommentShareAshish_Panswered 10 months ago0Unless the AWS Certification Exam Security team informs you that you need to retake the exam at an agreed upon date/time/location, you are required to pay for your next exam attempt.CommentShareKimWD-AWSanswered 10 months ago"