Question: AWS App Runner alternatives?

"Hi, everyone!Im want to run my app on cloud (thinking about AWS) but dont have any DevOps experience to manage the whole thing by myself.During my research I`ve stumbled upon AWS App Runner which seems can do the trick for me, but maybe there are other tools and clouds to do so.I want to focus on the app rather than cloud management, I use docker for the app, but could theoretically switch to the Kubernetes as it seems to be way more popular.Would appreciate your thoughts and suggestions, maybe some drawbacks of AWS App Runner I should know before start using it?FollowComment"

Answer: "0AWS App Runner is a fully managed service that makes it easy to deploy and run containerized applications in the cloud. It allows you to build, test, and deploy your applications quickly and easily, without having to worry about the underlying infrastructure.One of the main benefits of using AWS App Runner is that it automates many of the tasks involved in deploying and scaling containerized applications, such as provisioning and configuring infrastructure, building and pushing container images, and updating and monitoring running services. This can save you a lot of time and effort, and allow you to focus on developing your application.AWS App Runner also integrates well with other AWS services, such as Amazon ECR and Amazon ECS, which can make it easy to manage and scale your application.Another option you can consider is using Kubernetes, which is a popular open-source container orchestration system. Kubernetes can run on various cloud platforms, including AWS, GCP, and Azure. Kubernetes allows you to easily deploy, scale, and manage containerized applications, and has a large and active community that can provide support and resources. However, it has steeper learning curve than AWS App Runner and might require more DevOps experience to manage it.In summary, if you're looking for a fully managed service to deploy and run containerized applications in the cloud, and you're OK with only using AWS, AWS App Runner may be a good choice for you. If you're looking for multi-cloud or more flexibility and control, you may want to consider using Kubernetes.CommentShareFrank Idugboeanswered 5 months ago0Thank you for detailed answer, Robert!I think that I might have found the tool for the job, especially since I use docker:https://wsp-aws.io/looks like it does what I need i think, but still in beta by the looks of it. Have you heard of it, what do you think?CommentShareYaroslav Baranovanswered 5 months ago"


Question: Configure GoDaddy subdomain to Route53

"Hi there,Basically, some customers want to use their own domain to access our web application through a subdomain, this will be a kind of "white label" so our customers' clients will not see our domain. This seems to be possible and simple but I am having difficulties.In the POC I am working on, the domain is hosted in GoDaddy, and there I created a single subdomain for this test, let's say: https://beta1.domainname.comIn Route53, I created a new "Hosted Zone" for the domain "beta1.domainname.com"and I also set up a new RecordSet:Type = AValue = My Reverse Proxy IP AddressIn GoDaddy, using the "Template" tool (My Domains> {Domain Name}> Manage DNS> Manage Templates) I configured this way:Record Type = CNAMEName = beta1.domainname.comValue = ns-???.awsdns-??.comTTL = 1/2 HourEven after searching and trying some settings, my tests only results in TimeOut.Can someone please guide me if I have forgotten something or if I am doing something wrong?Regards,FollowComment"

Answer: "0I followed this procedure as well.  I have a hosted zone on my AWS that is just to use an API gateway for a parent domain hosted on godaddy.  I have taken the 4 NS servers and put them in as records with the full subdomain name on the godaddy dns config.  However, I am still not getting the traffic routed correctly to my AWS hosted zone.  Do I need to add a subdomain and forward it to something in the Godaddy DNS management or just add the 4 NS entries?I know my AWS side is correct because if I route the enter parent domain by replacing the Nameservers with these 4, it works, bur I lose the ability to route to my parent domain (all non sub).Thanks.CommentSharewowguy99answered 2 years agorePost-User-5501957 3 days agoDid you put the whole fdqn in the godaddy NS record or just the subdomain name?Example from above should be like this.Record Type = NSName = beta1Value = ns-???.awsdns-??.comTTL = 1/2 HourIf you did this in GodaddyRecord Type = NSName = beta1.domainname.comValue = ns-???.awsdns-??.comTTL = 1/2 HourThe subdomain you are technically delegating name service for is "beta1.domainname.com.domainname.com"Share0Hi,Thank you for reaching out to us! I understand you want to host subdomains on R53 and  your parent domain is hosted on GoDaddy.The procedure you are following is right, expect that you are creating CNAME at go daddy for your subdomain.To have subdomain delegated to R53, you would need to create a NS record at GoDaddy with the name servers given by  R53 hosted zone and not CNAME.For ex)Record Type = NSName = beta1.domainname.comValue = ns-???.awsdns-??.comTTL = 1/2 HourPlease look at https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingNewSubdomain.html#UpdateDNSParentDomain for further information.Have a nice day! :)CommentShareGGanswered 5 years ago0Same issue, i think it's on godaddy's side. NS with fqdnCommentSharedysectanswered 2 years ago0And if any of you ever provided the actual domain names you're using other forum members could look at the setup, as seen in the public information on the internet, and possibly give you pointers.CommentShareJonTRanswered 2 years ago"


Question: Mixed Fleet configuration for Elastic memcache Cluster

"Hi,Is there is a way we can have different nodes types in an Elastic Memcache cluster?If not, Is there a plan to support that in future ?This is going to be really helpfully while vertically scaling up the cluster.FollowComment"


Question: How to transfer a domain from route 53 to GoDaddy or Google domains??

Bought a domain on route 53.Need to transfer to GoDaddy/Google domains.How??Also is there a possibility of setting up a subdomain on a domain bought from route 53??TIAFollowComment

Answer: "1HiIf you want to transfer the Domain from Rout3 53 to Godaddy , Please look at the link Transferring a domain from Amazon Route 53 to another registrarPlease look into the link above to follow the steps to get your DNS transfer to the other provider, If you transfer the domain to other providers you will lose the great functionality of the route53Alias records. For more information, see Choosing between alias and non-alias records.Routing policies other than the simple routing policy. For more information, see Choosing a routing policy.Health checks that are associated with records. For more information, see Configuring DNS failover. Subdomain:Yes of course you can create sub domains in route 53, Route 53 is like the other DNS provider but also you will have the extra features described aboveIn the hosted zone for the domain, choose Create record.For Name, enter the name of the subdomain.For Value, enter the IP adress of the server.For Record type, choose A used for the IPV4 adressFor TTL (Seconds), used defaultFor Route Policy, choose Simple routing.Choose Create Records. thats it.If you have questions still comment here otherwise make as answerCommentShareGKanswered 3 months ago0Yes, there is a documented process to move a domain from Route 53 to another registrar.https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-transfer-from-route-53.htmlIt is also possible to create subdomains within Route 53.https://aws.amazon.com/premiumsupport/knowledge-center/create-subdomain-route-53/CommentShareDarren Ranswered 3 months agoEXPERTkentradreviewed 3 months agodansingh 3 months agoWhy choose GoDaddyThheir services terrible and pricey. I was transfer out ally domainsShare"


Question: CodeGuru integration with GitHub Actions has inconsistent behavior?

"We are currently attempting to integrate CodeGuru Reviewer with GitHub actions to scan our code in a GitHub repository.When dispatching the GitHub actions CodeGuru workflow manually, this generates a full repository scan on CodeGuru for our GitHub repository. This full repository scan shows all of the findings in the GitHub repository.When triggering the GitHub actions CodeGuru workflow through a GitHub pull request, this generates an incremental scan on CodeGuru for our GitHub repository. In theory, this incremental scan should only scan the code that was changed in our GitHub pull request. However, according to CodeGuru, the amount of lines that are scanned during an incremental scan are equivalent to the amount of lines that are scanned during a full repository scan.Additionally, when the incremental scan is performed, not all recommendations from the full repository scan are found. When the incremental scan results file is compared to the full repository scan results file, the outcome is that GitHub reports that all recommendations from the full repository scan have been fixed. However, this is not the case, and no fixes were actually provided in the pull request. The behavior seems to report that because the recommendation was not found in the incremental scan, then the recommendation must have been fixed from the full repository scan. I would expect the recommendation to only be resolved if an actual fix is committed in the corresponding pull request.I also do not understand why the SARIF file is not pushed during a GitHub push event. According to the GitHub Actions for CodeGuru Reviewer, the Upload Review Result step for uploading the SARIF file to GitHub is skipped if the GitHub event is equal to push. https://github.com/marketplace/actions/codeguru-reviewerWhy is the SARIF upload skipped if the GitHub event is pushed? I don't see any explanation for why this logic is in place to skip the SARIF upload to GitHub if the GitHub event is a push.Lastly, there does not seem to be any documentation for when this GitHub workflow is to be triggered. I found some lines in a YouTube explanation video, showing when the GitHub workflow is triggered, but there is no additional documentation in the GitHub Actions for CodeGuru Reviewer. Could the documentation be appended to add additional information about when this particular workflow should be executed? https://www.youtube.com/watch?v=czlx4iixe0YThanks for any help and information that you can provide!FollowCommentViraj 2 months agoDo we have any updates on this?Share"


Question: AWS Transit Gateway monitoring with Cloudwatch

Does Transit Gateway support detailed monitoring (i.e. 1 minute interval)?FollowComment

Answer: 0Accepted AnswerCloudWatch metrics are reported in 60-sec intervals for Transit GatewayAmazon VPC publishes data points to Amazon CloudWatch for your transit gateways and transit gateway attachments.andAmazon VPC measures and sends its metrics to CloudWatch in 60-second intervals.CommentShareDaniel_Yanswered 3 years ago


Question: Error when trying to update an item in DynamoDB via management console

"I've got a 17KB item stored in Dynamo. If I open it in the management console (https://eu-west-1.console.aws.amazon.com/dynamodbv2/home?region=eu-west-1#edit-item?table=TABLE&itemMode=2&pk=PRIMARY_KEY&sk&route=ROUTE_ITEM_EXPLORER) and hit Save Changes button, I get the warning message below:The update request failed with the response below. The request can proceed by overwriting the item.Tick this box to confirmInvalid ConditionExpression: Expression size has exceeded the maximum allowed size; expression size: 4255I can proceed and update the item after ticking the box, but I'd like to know what is going on. What expression is this message talking about?Any help is appreciated.FollowComment"

Answer: 0You are probably hitting Expression Parameters limits. Please refer to: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Limits.html#limits-expression-parametersCommentShareEXPERTDaniel ABIBanswered 5 months ago0Could you please elaborate your answer? I'm afraid I can't follow you.CommentShareDenisanswered 5 months ago


Question: Multiple Kinesis Firehose Destinations

"A customer wants to use Kinesis for gathering and aggregating log data from multiple accounts into a central account. They have two destinations - 1. S3 (using parquet transformation for easy Glue/Athena access), 2. ElasticSearch (for visualization and common queries). The question is what is the AWS recommended approach for this and why?These are the three approaches that come to mind, however looking for more guidance:A. Using Kinesis Data Stream as the primary delivery mechanism, and use that to feed two Kinesis Firehose streams - each one targeted at one of the destinations (see above).B. Using Kinesis Firehose as the primary delivery mechanism, targeting initial delivery into S3 (with parquet conversion), and using an S3/Lambda trigger to load the data into ElasticSearch.C. Using Kinesis Firehose as the primary delivery mechanism, targeting both S3 (raw - not converted) delivery and ElasticSearch delivery. Then using an S3/Lambda trigger to transform the raw S3 data into parquet format saved back into S3.FollowComment"

Answer: "0Accepted AnswerI have spoken with several others about this same question and the answer really boiled down to this:There are many ways to move data around AWS, and many of them can be the 'right' way depending on several factors such as velocity, volume, data sources, data consumption patterns and tools, and more. In short - there is no blanket 'right' answer, it will depend on the specific context.The initial proposed approach (Using Kinesis Data Stream as the primary delivery mechanism, and use that to feed two Kinesis Firehose streams - each one targeted at one of the destinations required) is an acceptable approach and pattern. However the question that should be answered is: does the customer want to create a 'raw data' bucket of these logs, or is the landed data (in either S3/parquet or Elasticsearch) the acceptable source of truth.The other patterns mentioned here by others are also acceptable patterns, however each should be reviewed for trade-offs and impacts to ensure that the solution matches the customer requirements and context (i.e. velocity, volume, data sources, data consumption patterns and tools, and more).CommentShareDavidG_AWSanswered 3 years ago"


Question: Cognito does not support the rotation of refresh tokens?

"Hello, I would like to know if AWS supports the rotation of refresh tokens.If not, why? Do you think to add this feature?FollowCommentAWS-User-Chirag SUPPORT ENGINEER8 months agoCan I request you to accept this answer in the link ? It will help me alot. ThanksShare"

Answer: "1Cognito doesn't support refresh token rotation. By increasing expiry time of refreshtoken we can extend the amount of time before the user needs to fully login again to obtain a new refresh token. I did found a 3rd party article regarding how to use the refresh token. [1]Link- https://advancedweb.hu/how-to-use-the-refresh-token-with-cognito/ -- [1]Regarding the feature request, I would recommend opening up a case with the AWS Support Team & work with them directly.CommentShareSUPPORT ENGINEERAWS-User-Chiraganswered 8 months agoHugo C 8 months agoThank you for your answerI will do thisShare"


Question: AWS instance scheduler not working

I have installed aws instance scheduler via cloudformation stack.  I have also configured a schedule and a period as well as added a tag to the ec2 instance.  i have verified all the settings are correct and i see the job being run on the schedule but it isnt stopping/starting the instance.FollowComment

Answer: "0Hello there, please check if your EBS volume is encrypted. If it is, then the issue may be that the IAM role used doesn't have the correct KMS permissions. If you are able to confirm that this is the issue then you'll need to grant the Instance Scheduler permission to use the customer master key (CMK) to start and stop instances. Add the kms:CreateGrant permission to the Instance Scheduler role (<stackname>-SchedulerRole-<id>)[1].If the above is not the issue, you will then need to check the Cloudwatch Log group for the instance sheduler lambda function, the log group created will have the below files[2]:InstanceScheduler-yyyymmdd: Logs general scheduler messagesCloudWatchEventHandler-yyyymmdd: Logs general Amazon CloudWatch event rule informationSchedulerSetupHandler: Logs the output of configuration actionsScheduler-<service>-<account>-<region>-yyyymmdd: Logs the service, account, and region of each scheduled instanceAdminCliRequestHandler-yyyymmdd: Logs requests from the admin CLIYou will need to look at each, but I recommend starting with InstanceScheduler-yyyymmdd, as any issues with starting/stopping the error would be seen here.CommentShareSUPPORT ENGINEERmogenianswered 2 months ago"


Question: DMS between MySQL RDS in 2 different accounts

What is the best approach to creating a read replica of an RDS instance in a different account than the source DB.?I have narrowed down the options to 2 approaches.Using the Data migration Service -  I started with this approach but could not find a way to create an endpoint that points to the RDS in a different accountCreate a replica in the same account. Stop replication once the replica has caught up. Take snapshot and restore it in the destination account and then set  the leader in this replicaFollowComment

Answer: 0this should help https://aws.amazon.com/premiumsupport/knowledge-center/rds-mysql-cross-region-replica/CommentShareAWS-User-8174525-subhashanswered a year ago


Question: "IoT Greengrass Docker deployment: If I change deployment to run a different docker component or different version thereof, the old docker container keeps running locally."

"Hi,I am using AWS IoT Greengrass to deploy a docker image that I saved in a private ECR repo to my Raspberry Pi. The deployment works fine. However, if I change the deployment (i.e. revise it) to run a different image and not the old one anymore, the old container still keeps running locally. I obviously want the old docker container to stop if I haven't included it in my deployment anymore.  This only happens if I shut down the RPI and restart it. How can Imake sure the old container stops immediately.My component recipe looks as follows, do I need to change anything therein?For completeness: The Docker container runs a Python script that enters an infinite while loop which prints "Hello, world!" every second. Maybe the continuous loop is the problem but I don't think so as I am able to stop the container through docker stop.{"RecipeFormatVersion": "2020-01-25","ComponentName": "com.example.MyPrivateDockerComponent_revised","ComponentVersion": "1.0.4","ComponentType": "aws.greengrass.generic","ComponentDescription": "A component that runs a Docker container from a private Amazon ECR image revised.","ComponentPublisher": "Amazon","ComponentDependencies": {"aws.greengrass.DockerApplicationManager": {"VersionRequirement": ">=2.0.0 <2.1.0","DependencyType": "HARD"},"aws.greengrass.TokenExchangeService": {"VersionRequirement": ">=2.0.0 <2.1.0","DependencyType": "HARD"}},"Manifests": [{"Platform": {"os": "all"},"Lifecycle": {"Run": "docker run --sig-proxy=True 242944196659.dkr.ecr.eu-central-1.amazonaws.com/test_repo:latest","Stop": "docker stop $(docker ps -q --filter ancestor=242944196659.dkr.ecr.eu-central-1.amazonaws.com/test_repo:latest)","Destroy": "docker rm $(docker ps -a -q --filter ancestor=242944196659.dkr.ecr.eu-central-1.amazonaws.com/test_repo:latest)"},"Artifacts": [{"Uri": "docker:242944196659.dkr.ecr.eu-central-1.amazonaws.com/test_repo:latest","Unarchive": "NONE","Permission": {"Read": "OWNER","Execute": "NONE"}}]}],"Lifecycle": {}}FollowComment"

Answer: "1Accepted AnswerHello,The problem is that you're using stop and destroy which I'm not sure where you got those from. Refer to the recipe reference here: https://docs.aws.amazon.com/greengrass/v2/developerguide/component-recipe-reference.html#recipe-format, you should use shutdown as the key to stop the component.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 3 months agorePost-User-9168686 3 months agoHi Michael, thank you for your answer. It worked!Share"


Question: Babelfish and the SQLSRV driver in PHP

Is there support for PHP with Babelfish using the SQLSRV driver? It doesn't throw any error message but the $conn returns as FALSE.Tested with python3 pyodbc library and it works fine.FollowComment

Answer: "0To support the driver, here is what needs to be done:By default the driver expects MARS to be switched ON. Since Babelfish does not support MARS we return MARS OFF in the Pre-login response, this is not expected by the PHP driver hence it times out gracefully.The workaround is to add “MultipleActiveResultSets=false” in the connection URL.CommentSharelightanswered a year ago"


Question: AWS Services for Text/Shape Extraction and Evaluation

"I have a bunch of test papers for an exam, with questions that include formulas, shapes, and text. I want to scan these papers and check the students' answers. What AWS services can I use for this?FollowComment"

Answer: "2Accepted AnswerAWS can provide you with some services but to accomplish this task you need to handle lots of thingsAWS services just can support you for this task.Amazon Textract: Textract can extract printed text (in several languages) from scanned documents, forms, and tables. It uses machine learning to read and process the text from your documents, effectively turning the content into machine-readable data. However, Textract primarily focuses on textual data and has limited support for complex figures, shapes, or handwritten text.Amazon Rekognition: This service can analyze images and videos for you. You can identify objects, people, text, scenes, activities, as well as any inappropriate content. For your use case, this can be useful to identify and interpret diagrams or shapes if any. Please note that complex recognition might require custom training of the model.Amazon Comprehend: Once the text is extracted, you can use Comprehend to understand the sentiment or the key phrases in the text. It's an NLP (Natural Language Processing) service that uses machine learning to find insights and relationships in a text.AWS Lambda: You can use Lambda to create a serverless application that ties together the various AWS services mentioned. AWS Lambda can be triggered when a new document is uploaded to an S3 bucket, process the document using Textract and/or Rekognition, and store the results in a database such as Amazon DynamoDB.Amazon A2I (Augmented AI): This is useful when you need human review of the ML predictions. If Textract or Rekognition are unable to accurately extract or identify content, A2I can help bridge the gap.Amazon SageMaker: If your problem is more complex and requires custom models for handwriting recognition or shape detection, SageMaker provides a complete set of tools to train, tune, and deploy your Machine Learning models.CommentShareEXPERTsedat_salmananswered 17 days agoalex 17 days agoLet me work on these services. I am searching the correct cloud services to solve this problem.Share"


Question: Monthly DynamoDB procedure - best practices help

"We run a system that collects data monthly, so we have several central tables, then more of a YYYY_MM structure.   So days before the new month we are creating a table, setting capacity, PITR, etc.  Then around the 6th, we will lower the capacity from the previous month, lower capacity, etc. and I want to automate this.  The only thought I had was using an admin server with AWS keys, and writing a script using CLI tools.   Naturally that user would need credentials, etc. but is there any other way that would be easier?Also regarding the backup, if I am using AWS Backup, once the previous month is done, I am trying to find out how I am charged, if the data doesn't change and I leave the daily flag on, do I pay for more storage (the same data over and over) or is it just the one time as the data is the same as that will affect that part.Thank you in advance.FollowComment"

Answer: "1Accepted AnswerMy suggestion here would be to use Amazon EventBridge which invokes a Lambda function on monthly basis. The logic in your Lambda can be used to change the tables capacity settings etc.. I would also suggest looking into DynamoDB Standard-IA table class which may suit your use-case.For Auth, you can attach an IAM role with the necessary permission to your Lambda function so it can make the desired updates. More hereFor DynamoDB Backups, you are only charged for the data stored, so if the data does not change then your monthly bill will remain the same.CommentShareEXPERTLeeroy Hannigananswered a year agolraymond a year agoLeeroy - regarding the data stored pricing.  How does it work if I make a tag called daily and after 30 days, that table stops getting written to, so in the aws backup I say to move to cold storage after 45 days?   The data doesn't change, but does the backup script run, look and see no warm backup and make a new one, or is it smart enough to say I have a backup there, its in cold storage, no data change and do nothing and I keep the cold storage savings?Share0Thanks Leeroy, have never used EventBridge due to I am a bash/linux guy and Lambda doesn't support, but I keep saying I need to get on to Python so here is yet another reason!Thanks muchCommentSharelraymondanswered a year agoLeeroy Hannigan EXPERTa year agoHonestly, you wont regret it. Its super powerful and easy to implement. If you need some examples to get you up in running with Python and DynamoDB, check out our repo hereShare"


Question: Workspaces MFA setup problem

"I am trying to configure Workspaces to use MFA.  I have tried setting up MFA in the AD Connector area and then tried in the Workspaces Directory area (not at the same time).  In both cases it goes from Creating to Failed.  On the MFA server we see a request from our expected AWS external IP with user awsfaketestuser during the MFA creation.  The security group used by AD connector has 1812 TCP/UDP allowed inbound and outbound is using a NAT gateway.    As we see the request from AWS on our RADIUS server, we don't suspect a network problem.  We have also tried creating a user on the RADIUS host called awsfaketestuser and setting it to disabled.   I'm not sure how to get more information about the error or how to fix the problem.FollowComment"

Answer: "0When a RADIUS server receives a request there are only four different ways it can respond.  It either sends back "Access Reject", "Access Challenge", "Access Accept", or it doesn't respond at all.  For example if the "shared secret" is wrong then it does not send a reply.  The awsfaketestuser test is verifying two things for us.  The first is that we have network connectivity and the second is that the shared secret is correct.  If either of those two fail then we get no reply back and the call times out.  These are the two main reasons MFA setup can fail.  In a successful test we are expecting to receive back a reply of "Access Reject".  One way you can troubleshoot this is to turn on VPC flow logs to the ENI attached to the AD connector to see if the return traffic from your RADIUS server is reaching the AD connector.CommentShareJoeD_AWSanswered a year ago"


Question: HelloWorld javax/xml/bind/JAXBException

"Following AWS’ own documentation to the letter herehttps://docs.aws.amazon.com/toolkit-for-eclipse/v1/user-guide/lambda-tutorial.html, I created the Hello World example function.I completed it on a clean install of the latest version of Eclipse (2021-12).I left the generated code handleRequest(Object input, Context context)  as it was because changing it as advised to (String input, … generated an error.When I select ‘Finish’ on the Function Configuration page I get the following error:An internal error occurred during: "Uploading function code to Lambda".javax/xml/bind/JAXBExceptionI have searched extensively on the web for javax/xml/bind/JAXBException solutions and workarounds and found nothing to get me any further.This problem repeats if I try, for example, an S3 function template instead of Hello World.Any and all insights much appreciated :)FollowComment"


Question: Codepipeline: "root is not authorized to perform: iam:PassRole"

"Hello,I'm trying to make codepipeline by cloudformation.But this error had occurred.User: arn:aws:iam::<user id>:root is not authorized to perform: iam:PassRole on resource: CloudFormationRoleHere is my code.#CloudFormationCloudFormationRole:    Type: AWS::IAM::Role    Properties:      AssumeRolePolicyDocument:        Version: "2012-10-17"        Statement:          - Effect: Allow            Principal:              Service: cloudformation.amazonaws.com             Action: sts:AssumeRole          - Effect: Allow            Principal:              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root             Action:              - sts:AssumeRole          - Effect: Allow            Principal:              Service: codepipeline.amazonaws.com            Action: sts:AssumeRole  CloudFormationServicePolicy:    Type: AWS::IAM::Policy    Properties:      PolicyName:         !Sub CloudFormationPolicy-${AWS::AccountId}            PolicyDocument:        Version: "2012-10-17"        Statement:          - Sid: CloudWatchLogsPolicy            Effect: Allow            Action:               - logs:CreateLogGroup              - logs:CreateLogStream              - logs:PutLogEvents            Resource: "*"          - Sid: S3ObjectPolicy            Effect: Allow            Action:              - s3:PutObject              - s3:GetObject              - s3:GetObjectVersion            Resource: "*"          - Sid: ECRPowerUserPolicy            Effect: Allow            Action:               - ecr:GetAuthorizationToken              - ecr:BatchCheckLayerAvailability              - ecr:GetDownloadUrlForLayer              - ecr:GetRepositoryPolicy              - ecr:DescribeRepositories              - ecr:ListImages              - ecr:DescribeImages              - ecr:BatchGetImage              - ecr:InitiateLayerUpload              - ecr:UploadLayerPart              - ecr:CompleteLayerUpload              - ecr:PutImage            Resource: "*"                  Roles:        - !Ref CloudFormationRole#CodePipelineCodePipeline:    Type: AWS::CodePipeline::Pipeline    Properties:      ArtifactStore:        EncryptionKey:          Id: !GetAtt KMSPrivateKey.Arn          Type: KMS        Location: !Ref CodeCommitS3Bucket        Type: S3      RoleArn: !GetAtt CodePipelineServiceRole.Arn      Stages:      - Actions:        - ActionTypeId:            Category: Source            Owner: AWS            Provider: CodeCommit            Version: 1          Configuration:            PollForSourceChanges: false            RepositoryName: !Ref RepositoryName            BranchName: master          Name: source          OutputArtifacts:          - Name: CodecommitArtifact          RoleArn: !GetAtt CodeCommitRole.Arn        Name: source      - Actions:        - ActionTypeId:            Category: Build            Owner: AWS            Provider: CodeBuild            Version: 1          Configuration:            ProjectName: !Ref CodeBuild          InputArtifacts:          - Name: CodecommitArtifact          OutputArtifacts:          - Name: CodebuildArtifact          Name: build        Name: build      - Actions:        - ActionTypeId:            Category: Deploy            Owner: AWS            Provider: CloudFormation            Version: 1          Configuration:            ActionMode: CHANGE_SET_REPLACE            RoleArn: !Ref CloudFormationRole            StackName: !Ref RepositoryName          InputArtifacts:            - Name: CodebuildArtifact          Name: GenerateChangeSet        Name: ChangeSetReplace      - Actions:        - ActionTypeId:            Category: Deploy            Owner: AWS            Provider: CloudFormation            Version: 1          Configuration:            ActionMode: CHANGE_SET_EXECUTE            RoleArn: !Ref CloudFormationRole            StackName: !Ref RepositoryName          Name: ExecuteChangeSet        Name: Deploy    CodePipelineServiceRole:    Type: AWS::IAM::Role    Properties:      ManagedPolicyArns:        - arn:aws:iam::aws:policy/AWSCodeCommitFullAccess        - arn:aws:iam::aws:policy/AWSLambdaFullAccess        - arn:aws:iam::aws:policy/AWSCodeDeployFullAccess        - arn:aws:iam::aws:policy/AWSElasticBeanstalkFullAccess        - arn:aws:iam::aws:policy/AWSCodePipelineFullAccess        - arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess         - arn:aws:iam::aws:policy/CloudWatchEventsFullAccess       AssumeRolePolicyDocument:        Version: "2012-10-17"        Statement:                     - Effect: Allow            Principal:              Service: codepipeline.amazonaws.com                          Action: sts:AssumeRole          - Effect: Allow            Principal:              AWS: !GetAtt CodeCommitRole.Arn            Action: sts:AssumeRole          - Effect: Allow            Principal:              AWS: !GetAtt CloudFormationRole.Arn            Action: sts:AssumeRole  CodePipelinePolicy:    Type: AWS::IAM::Policy    Properties:      PolicyName:         !Sub CodePipelineServicePolicy-${AWS::AccountId}      Roles:         - !Ref CodePipelineServiceRole      PolicyDocument:        Version: "2012-10-17"        Statement:           - Effect: Allow            Action: sts:AssumeRole            Resource: !Sub arn:aws:iam::${DevelopAccountID}:role/*          - Sid: "S3Policy"            Action:               - s3:PutObject              - s3:GetObject              - s3:GetObjectVersion              - s3:GetBucketVersioning            Resource: "*"            Effect: Allow                      - Sid: CodeBuildPolicy            Action:              - codebuild:BatchGetBuilds              - codebuild:StartBuild            Resource: "*"            Effect: Allow          - Sid: ECSPolicy            Action:               - ecs:DescribeServices              - ecs:DescribeTaskDefinition              - ecs:DescribeTasks              - ecs:ListTasks              - ecs:RegisterTaskDefinition              - ecs:UpdateService              - iam:PassRole            Resource: "*"            Effect: Allow          -             Effect: Allow            Action: kms:*            Resource: "*"How can I solve this problem?I really appreciate any help.Thanks in advance.FollowComment"

Answer: "0Accepted AnswerHi,I was able to reproduce the "not authorized to perform iam:PassRole" error.To fix that error, I had to change:           ActionMode: CHANGE_SET_REPLACE            RoleArn: !Ref CloudFormationRoleTo:           ActionMode: CHANGE_SET_REPLACE            RoleArn: !GetAtt CloudFormationRole.ArnAnd also change:            ActionMode: CHANGE_SET_EXECUTE            RoleArn: !Ref CloudFormationRoleTo:            ActionMode: CHANGE_SET_EXECUTE            RoleArn: !GetAtt CloudFormationRole.ArnThat should hopefully unblock you on the "not authorized" error message.Hope this helps,-randyEdited by: RandyTakeshita on Sep 4, 2019 7:11 AM - removed last comment block..CommentShareRandyTakeshitaanswered 4 years ago0Hi,Have you verified that the actual user that is launching the CloudFormation stack has the iam:PassRole permission?-randyEdited by: RandyTakeshita on Sep 3, 2019 12:04 AMCommentShareRandyTakeshitaanswered 4 years ago0Hello,  RandyThank you for your replyI'm operating on root user. So user has iam:PassRole permission.CommentSharetetsuroanswered 4 years ago0I reproduced error.Thank you so much for your advice.CommentSharetetsuroanswered 4 years ago"


Question: Amazon Macie question

"Can Macie consolidate the findings across various regions and report from one central location (like Security Hub), or does it have to be enabled region wise?FollowComment"

Answer: "2Accepted AnswerYes, you can publish your Macie findings to a central location like Security Hub. However, note that Macie and Security hub are regional services but Security hub supports cross-region aggregation of findings.https://aws.amazon.com/about-aws/whats-new/2021/10/aws-security-hub-cross-region-security-posture/CommentSharerePost-User-5076019answered 6 months agorePost-User-Okemmanu 6 months agoThank you very much. This is helpful.Share"


Question: API Gateway integration with DAX

"Is there a way to use a service integration from API Gateway (REST) for DAX?I know we can use a service integration for DynamoDB, but DAX is supposed to be a transparent replacement with respect to the API.Seems like a big waste to reintroduce a Lambda in between just because I want to add caching, and this goes against the 'Servicefull' best practice.FollowComment"

Answer: "0I don't think it's going to be possible as DAX is deployed inside a VPC so even if it would be possible to call DAX directly from API gateway, it would be possible only for Private REST API.If you don't use DAX for anything else, you could still implement the caching at rest Api level instead of using DAXCommentShareMikianswered a year ago0There isn't a way to achieve this without using a Lambda in between, that too a VPC Lambda which could very well defeat the purpose of using a caching system to reduce data access latencies.Using DynamoDB directly may be a better option here and using APIGW caching if applicable.CommentShareAman Dhingraanswered a year ago"


Question: Prevent CodePipeline from executing on create

"I've built an orchestration layer using step functions and cloud formation to spin up pipelines based on CloudFormation templates included in a project's Git repository.   One of the things I'm running into is if a CloudFormation template didn't change, I have to manually kick off the pipeline - whereas if it created the stack, it runs automatically.    I'd much rather be in full control of when that pipeline kicks off.Is there a way to prevent execution upon creation of the Code Pipeline?FollowComment"

Answer: "0Unfortunately, it is not possible to disable the initial CodePipeline execution. There is a feature request already in place but I would not be able to share the ETA or whether the feature would be released. I have added your voice to the feature request. A workaround is to Add a manual approval action to a pipeline in CodePipeline.CommentShareTaka_Manswered 10 months ago"


Question: Permissions to publish to your notification topic

"Hello,I have a question about SNS Publish topic. I have received a error message as below:Also, I try to set policy permission to full and my account is admin Access. So, I opened case to request remove SMS Sandbox. And, AWS Team resolved.Who can help me? ThanksFollowComment"

Answer: "0From the error message it looks like the role being used by Sagemaker does not have permission to publish to SNS. You need to attach a policy to the role that grants Sagemaker the ability to publish SNS messages to the relevant topic.CommentShareEXPERTIndranil Banerjee AWSanswered 7 months agolqvan 7 months agoHello Indranil,I think I attached the right permission. You can see this picture: https://1drv.ms/u/s!Alcer1f10FI6itBh-46Md-YtBtyCWw?e=C1KqYfShare0Hello,Not all resources support * at the beginning of the name. So try with only * just to rule it out. But as you said in your question, you have added Admin rights, so it's probably not that.I would first look at the SNS topic policy to ensure it's not blocking anything, then have a look at the role permissions boundary.In some cases, I have seen the real errors "hide behind" an AccessDenied, like a wrong key och S3 giving AccessDenied instead of 404. And Creating an ECS cluster will fail on AccessDenied because its lacking tagging permission even though you can create a cluster. So an overall sanity check of the rest of your config could help.Hope it helps!CommentShareCarl Ostrandanswered 7 months ago"


Question: How to add custom metadata to a model in model registry via sagemaker pipeline step?

"based on sagemaker python sdk  , i can add custom/customer metadata via (sample code below). i am planning to use sagemaker model step and register the model in a model package group and create an end to end pipeline. is it possible to add these metadata at the time of model creation or registering model ?boto3.client('sagemaker').update_model_package( ... CustomerMetadataProperties = {'key1': 'value1', 'key2': 'value2'})FollowComment"

Answer: "1Accepted AnswerYes, it is possible. You can add custom metadata when you use the register method of the Model object in the SageMaker SDK. The Model step from SageMaker Pipelines can then be used together with this register method.Below is a snippet of code copied from the example provided on this page, where I have added the custom_metadata_properties parameter with your example input.register_model_step_args = pipeline_model.register(    content_types=["application/json"],   response_types=["application/json"],   inference_instances=["ml.t2.medium", "ml.m5.xlarge"],   transform_instances=["ml.m5.xlarge"],   model_package_group_name="sipgroup",   customer_metadata_properties={"key1": "value1", "key2": "value2"})step_model_registration = ModelStep(   name="AbaloneRegisterModel",   step_args=register_model_step_args,)CommentShareS_Mooseanswered a month ago"


Question: rdsadmin.rds_file_util.read_text_file function throws ORA-22813

"I am having a problem when calling function rdsadmin.rds_file_util.read_text_file at Oracle database 12.1.0.2.v18. For example this code (taken from official doc [1]):select * from table    (rdsadmin.rds_file_util.read_text_file(        p_directory => 'DATA_PUMP_DIR',        p_filename  => 'import.log'));throws this error:ORA-22813: operand value exceeds system limits22813. 00000 -  "operand value exceeds system limits"*Cause:    Object or Collection value was too large. The size of the value           might have exceeded 30k in a SORT context, or the size might be           too big for available memory.*Action:   Choose another value and retry the operation.It does not matter which parameters are used. Even this call throws the same error:select * from table    (rdsadmin.rds_file_util.read_text_file(        p_directory => 'NONEXISTENT_DIR_NAME',        p_filename  => 'nonexistent-file-name.log'));Other function from the same package RDSADMIN.RDS_FILE_UTIL.LISTDIR works fine. I tried to restart the whole DB instance but it did not help.I am quite sure the READ_TEXT_FILE procedure used to work at 12.1.0.2.v12 database engine.Links:[1]: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.CommonDBATasks.Misc.htmlEdited by: mjiricka on Nov 28, 2019 5:18 AMFollowComment"

Answer: "0Fortunately it is possible to reimplement the rdsadmin.rds_file_util.read_text_file util like this:function read_file(p_directory varchar2, p_filename varchar2) return varchar2 as  v_file utl_file.file_type;  v_buffer_size pls_integer := 32767;  v_buffer varchar2(32767);  v_output varchar2(32767) := '';begin    v_file := utl_file.fopen(p_directory, p_filename, 'r', v_buffer_size);    loop      begin        utl_file.get_line(v_file, v_buffer);        v_output := v_output || CHR(10) || v_buffer;              exception when no_data_found then exit;      end;    end loop;    utl_file.fclose(v_file);    return v_output;end;It works for shorter logs up to 32767 characters in length. Otherwise it should be possible to use CLOB instead of VARCHAR2, but VARCHAR2 is enough for reading e.g. task logs from rdsadmin.rdsadmin_s3_tasks.upload_to_s3.CommentSharemjirickaanswered 3 years ago"


Question: Trash

"Hi,Does WorkMail automatically empty the trash folders? If so is it possible to disable this?Thanks!FollowComment"

Answer: "0Hi,WorkMail does not automatically remove messages from the deleted items or trash folder. But messages that are deleted from the "Deleted items" folder will be removed after 30 days. During these 30 days items can be recovered from the "Recover deleted items".Kind regards.RobinCommentShareMODERATORrobinkawsanswered 4 years ago"


Question: "AWS batch jobs - Array size is limited from 2 to 1000 - not max of 10,000 as it claims?"

"The AWS batch job interface seems to have changed over the weekend and now I find that I can't make any jobs with an array size of over 1000. This is despite the fact that the Array Size help text says "When you create an AWS Batch job, you can turn on Array job. In the Array size box, enter a number between 2 and 10,000 to define how many child jobs are created." However, if I try to enter an array size > 1000 and then go to the next page then the array size box turns red and it gives me an error saying "This value must be an integer between 2 and 1000" and it doesn't let me proceed.On the previous interface we'd set the array size up to 10000 and just set the Number of Files to Process per Container to something small in the command line with no problem, so I'm not sure why it's changed now (did someone just miss a zero during the interface update or something, since the help text actually does say "between 2 and 10,000"?). Or are we missing something else here?We need to run our batch processes on many thousands of files so being limited to 1000 each time would be a bit more inconvenient. For example, I'd previously set the array size to 5996 and the Number of Files to Process per Container to 4 to process 23984 files - but if this sticks then now I'd have to set the array size to 1000 and Number of Files to Process per Container to 24? Would each job even be able to handle that many files at once?Either way, if the help text says one thing for the limit and the interface says another then that's probably something that needs to be fixed.FollowComment"

Answer: 0They appear to have fixed it - looks like I can enter array sizes over 1000 now!CommentSharecthomasanswered 7 months ago


Question: Adding our own worker to MWAA

"Hi,I was wondering if it was possible (or in the roadmap) to add our own Worker to MWAA ?We are currently running 95% of our dags on MWAA with small workers.but the 5% left are more compute heavy and crash MWAA worker even if we scale up.We have some machines at the office that we could use has worker to compute those dags.Is that something we can (/will be able to) do?We could tell the heavy compute dags to go in a specific queue and our worker at home would listen only to those queue.Thanks for your feedbacks in advanceFollowComment"

Answer: "0Hi!Worker pool support is not on the immediate roadmap for MWAA, so the recommendation is to run those few high-compute workloads on AWS Batch, ECS, or EKS--an example of the latter at https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-eks-example.htmlThanks!CommentShareJohn_Janswered 2 years ago0Thanks !I'll take a look.CommentShareLouisAWanswered 2 years ago"


Question: Amazon ECS/SQS/lambda/

"Good morning everyone,I am just starting in the AWS world and I have a challenge that I need to solve with the most appropriate tools that AWS offers me.The use case is the following: I have to process some pdf documents add some images to them and send it back.Currently I am doing it with a microservice that receives a pdf and returns it modified.When I do load tests the queue receives 50 requests and in the bash task I get blocked with 9 pdf at the same time and the ECS crashes.One solution is to increase the capacity of the ECS so that the microservice can process more documents. But I have read that SQS can help me solve this so I want to be sure I am applying the right architecture:I have a .net core microservice in docker that produces requests and sends them to the queue.I have an SQS that receives requests and arranges them in order of arrival.I have a lambda that listens to the SQS and when a new request arrives it fires the event to the consuming microservice (the lambda "fires" up to 10 times simultaneously and in each "firing" it lets only 1 document through, or they recommend that in each "firing" it lets 10 documents through).The consuming microservice receives a message from the lambda and starts processing all the SQS requests until all of them are finished.When finished and the SQS is emptied the lambda again is waiting for the SQS to have a new message and the cycle starts again.Overview:I have a microservice is publisher.The microservice is consumerThe lambda is the triggerThe SQS is the queueFollowComment"

Answer: "1Whether you can use SQS or not will depend on whether your requirement is to process the files synchronously or you are OK processing them asynchronously.If asynchronous processing is fine, then yes SQS can help you buffer requests so your back-end can process the requests.You did mention Lambda and .NET. Hopefully your framework is .NET Core because Lambda cannot run .NET Framework as Lambda microVMs are essentially Linux based.If the above conditions are met and you want to use Lambda with SQS, then please go through this document and understand how Lambda works with SQS thoroughly, because with SQS, Lambda polls batches of messages and there are some parameters such as batch size and batch window and queue visibility timeout that you have to configure correctly to get the best performance - https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.htmlAlso if you are handling large files, use a combination of SQS and S3, as mentioned here - https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-s3-messages.htmlCommentShareEXPERTIndranil Banerjee AWSanswered 9 months ago"


Question: Identifying EC2 Instance Store Volumes

A customer wants to find an automated way to identify EC2 Instance Store Volumes for a fleet of their Linux instances. Is there a way to do so that doesn't require logon to each Linux instance?FollowComment

Answer: "0Accepted AnswerHi,One way is to use the instance metadata service, but that would rely on connecting to each instance in turn. However, we know that the block device mapping can tell us if a volume is EBS-based or instance store-based. If a volume is instance store based, then the mapping will name it ephemeral[0-23], for example ephemeral4. Outside of logging on to an instance, we can use the EC2 API to get the block device mappings, a little like so:ec2 describe-instanceswill return you a list of Instance IDs, which you can then pass in (using a loop, likely best) to:ec2 describe instance-attribute --attribute block-device-mapping --instance-id $idIt shouldn't be too hard to polish that in to a nice bit of Bash etc. you can run on a loop.CommentShareEXPERTAndrew L.answered 4 years ago"


Question: EC2 Instance Error (Failed to Connect)

"Failed to connect to my instance EC2 Instance Connect is unable to connect to instance. I have an EC2 instance, now I can't connect to it using SSH service, and I can Ping to the Server IP and the System and status checked is passed also.FollowComment"

Answer: "1Accepted AnswerIf you are unable to connect to your EC2 instance using SSH, there could be several reasons why this is happening. Here are a few troubleshooting steps you can take:Check the Security Group: Make sure that the Security Group associated with your EC2 instance allows incoming SSH traffic from your IP address. To check this, go to the EC2 console, select your instance, and look at the Security Groups tab in the details pane. Verify that the inbound rules allow SSH traffic from your IP address.Check the Network ACLs: If you are using Network ACLs, verify that the rules allow incoming SSH traffic from your IP address.Verify the Instance Connect: Verify that you have the EC2 Instance Connect client installed on your local machine. If you do not have it installed, you can download it from the AWS website.Check Instance Connectivity Status: Check the instance connectivity status in the EC2 console to ensure that the instance is running and has not been stopped or terminated. Also, make sure that the instance is in the correct subnet and that the subnet has internet connectivity.Check the SSH key: Verify that you are using the correct SSH key to connect to the instance. If you have lost the private key, you will need to create a new one and associate it with the instance.Try a different method: Try connecting to the instance using a different method, such as Session Manager or the EC2 serial console. If you are able to connect using a different method, you can troubleshoot further to identify the issue with SSH.If you have tried these steps and are still unable to connect to your EC2 instance, you may need to contact AWS support for further assistance.CommentShareAWS_Guyanswered 3 months agorePost-User-2716796 3 months agoWe already follow above steps. Also we did contacted to AWS support but the result still the same since AWS support asked us to follow the tutorial which lead to the same result. Thanks.Share"


Question: GGv2 StreamManager connection error

"Hi there,I used the stream manager to upload video file to s3. I have 2 devices running with the same firmware version. but one of the stop sending data to s3here is the error I can find in the log2022-09-12T01:19:41.495Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. 2022 Sep 12 11:19:41,492 [ERROR] (pool-7-thread-2) com.amazonaws.iot.greengrass.streammanager.export.upload.MessageUploaderTask: Encountered Throwable when exporting messages. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.495Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. com.amazonaws.SdkClientException: Unable to execute HTTP request: Input/output error. 2022-09-12T01:19:41.496Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleRetryableException(AmazonHttpClient.java:1207) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.496Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1153) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.497Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:802) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.497Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:770) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.498Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:744) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.498Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:704) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.499Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:686) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.500Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:550) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.500Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:530) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.501Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:5437) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.501Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:5384) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.502Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.services.s3.AmazonS3Client.access$300(AmazonS3Client.java:421) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.502Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.services.s3.AmazonS3Client$PutObjectStrategy.invokeServiceCall(AmazonS3Client.java:6508) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.503Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.services.s3.AmazonS3Client.uploadObject(AmazonS3Client.java:1856) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.503Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.services.s3.AmazonS3Client.putObject(AmazonS3Client.java:1816) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.503Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.iot.greengrass.streammanager.export.destination.S3TaskDestination.makeSinglePutRequest(S3TaskDestination.java:435) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.504Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.iot.greengrass.streammanager.export.destination.S3TaskDestination.sendMessage(S3TaskDestination.java:155) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.504Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at com.amazonaws.iot.greengrass.streammanager.export.upload.MessageUploaderTask.upload(MessageUploaderTask.java:77) ~[AWSGreengrassGreenlake-1.0-super.jar:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.505Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1700) [?:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.505Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}2022-09-12T01:19:41.506Z [INFO] (Copier) aws.greengrass.StreamManager: stdout. at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]. {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}Thanks for your helpFollowComment"

Answer: "0Hello,The error Unable to execute HTTP request: Input/output error  seems to indicate some sort of lower-level issue with the availability/upload of the video file.Looks like the actual S3 PutObject request is failing, so I am wondering if there is an issue with the video file itself. Seems it is reaching this point in the SDK: https://github.com/aws/aws-sdk-java/blob/master/aws-java-sdk-core/src/main/java/com/amazonaws/http/AmazonHttpClient.java#L1219Are there any other logs, and is Stream Manager attempting to retry the upload?How is the video file being generated and can you confirm that it is valid at the time of upload? Are you also sending any other messages on the stream apart from the video file?Thanks!CommentShareavipinkuanswered 9 months ago"


Question: Facing issues in rtmp push inputs

"Hi,I am creating two channels and I am creating separate inputs for both of them which are of type rtmp push inputs but the one input that is created first time for the channel is working but when I stream with separate channel and I create same type of settings and create an input of rtmp push it does not work it says video not detected and audio not detected.FollowComment"

Answer: "0himanshubhattPlease private mail the MediaLive channel ARN of both the working and non-working channels and we can take a look at the issue.In the meantime, things to check for:Validate the Input Security Group used in both channels.Validate that the upstream device sending RTMP to the MediaLive channels are configured with the correct destination IP addresses.Validate the RTMP AppName and AppInstance configured in your upstream RTMP device matches the AppName and AppInstance configured in the MediaLive Inputs.CommentShareAWS-User-5437070answered 4 years ago0How to do a private email I don't know but same thing I am doing from the admin account it is working but not in other account. I am able to create the channel and create the inputs but when i start streaming it says input not found.Edited by: fxeataws on Sep 10, 2019 8:37 AMCommentSharehimanshubhattanswered 4 years ago0himanshubhattThe non-working channel has the RTMP AppName/AppInstance set to "a/b".Additionally, the non-working channel is not receiving a/b, instead the source is publishing to the AppInstance "test2". This source will therefore be ignored, since it does not match the RTMP AppName/AppInstance in the channel configuration.Please set your upstream RTMP source to send to the same RTMP AppName/AppInstance as defined in the MediaLive channel, or edit the MediaLive Input to match the RTMP AppName/AppInstance as defined in the upstream source.CommentShareAWS-User-5437070answered 4 years ago0But I am pushing the rtmp through obs stream to .rtmp://52.11.255.152:1935/a/bstreamkey:test2still it is not detectingand test2 is the name of the input that we have to attach it asks for the id of the media input and then from the dropdown i select the media input id.Edited by: himanshubhatt on Sep 10, 2019 9:15 AMCommentSharehimanshubhattanswered 4 years ago0Hi himanshubhatt,You need to move the "b" from your address into the "streamkey" field.In OBS, the Application Instance is called the Stream Key.Regards,SteveCommentShareSteve_Wanswered 4 years ago"


Question: LoRaWAN Gateway Connection Authenticated/Connection Ended Loop

"We are experiencing issues with Multitech Conduit AP LoRaWAN gateways where they will, without any outside change, go into a loop where they constantly ask to connect, get authenticated and then disconnected a few seconds later. They stay in the loop state - sometimes permanently, sometimes connecting after many hours. We have been logging the issue on Cloudwatch and the infuriating thing about this issue is that a gateway will be stable for weeks, then suddenly go into this death spiral.For context, all gateways are updated to version 6.x firmware and are using LTE connection. Sometimes a connectivity reset of the SIM connection will bring the gateway back, but not always.Example from logs below.....anybody else had this issue and know what it might be?2023-04-27T11:33:26.358+01:00{"resource": "WirelessGateway","wirelessGatewayId": "2b009a12-1bb7-4cea-9337-03ea52a634eb","wirelessGatewayType": "LoRaWAN","event": "Certificate","logLevel": "INFO","message": "Gateway connection authenticated. (CertificateId: 729f3b56d716d74293ded464bb01e21a3c088e8d561667acb095b8cce3ca3299, WirelessGatewayId: 2b009a12-1bb7-4cea-9337-03ea52a634eb)"}2023-04-27T11:33:28.840+01:00{"resource": "WirelessGateway","wirelessGatewayId": "2b009a12-1bb7-4cea-9337-03ea52a634eb","wirelessGatewayType": "LoRaWAN","event": "Certificate","logLevel": "INFO","message": "Gateway connection ended. (CertificateId: 729f3b56d716d74293ded464bb01e21a3c088e8d561667acb095b8cce3ca3299, WirelessGatewayId: 2b009a12-1bb7-4cea-9337-03ea52a634eb)"}2023-04-27T11:33:30.840+01:00{"resource": "WirelessGateway","wirelessGatewayId": "2b009a12-1bb7-4cea-9337-03ea52a634eb","wirelessGatewayType": "LoRaWAN","event": "Certificate","logLevel": "INFO","message": "Gateway connection authenticated. (CertificateId: 729f3b56d716d74293ded464bb01e21a3c088e8d561667acb095b8cce3ca3299, WirelessGatewayId: 2b009a12-1bb7-4cea-9337-03ea52a634eb)"}2023-04-27T11:37:32.110+01:00{"resource": "WirelessGateway","wirelessGatewayId": "2b009a12-1bb7-4cea-9337-03ea52a634eb","wirelessGatewayType": "LoRaWAN","event": "Certificate","logLevel": "INFO","message": "Gateway connection authenticated. (CertificateId: 729f3b56d716d74293ded464bb01e21a3c088e8d561667acb095b8cce3ca3299, WirelessGatewayId: 2b009a12-1bb7-4cea-9337-03ea52a634eb)"}FollowComment"

Answer: "0Hi Mark. It's unclear to me whether you've inspected any logs on the gateway. If not, please do so. Please share some gateway log snippets here. Thank you.CommentShareEXPERTGreg_Banswered a month ago"


Question: Why does my terminal glitches line like this?

Whenever I use the terminal the display gets all wack and I can't figure out why. Whenever I work on a few lines it automatically turns back to the first line and overrides the previous lines. I don't know how to really explain / describe it so here is a video of my work screen.https://youtu.be/BB5kflYLCLwFollowComment


Question: Microsoft SQL DMS Source CDC migration to S3 Target unsuccessful

"I have a Windows_Server-2019-English-Full-SQL_2022_Standard-2023.03.15 running on an EC2 instance as a source for DMS to be migrated to S3 target. I am using RDP to connect to the instance and SSMS to configure database.The migration succeeds when a full-load-only migration task type is used, but fails with full-load and ongoing replication and CDC-only migration task types. The database has a user that has the sysadmin, and db_owner roles. My user has SELECT, EXECUTE, VIEW SERVER, VIEW DATABASE permissions.  Full DB backup was done. CDC enabled on both table and DB. A Distributor & publisher is set-up. My table has a primary key, and no unique index. I am using a DMS Instance engine_version = "3.4.7" type "dms.t2.micro".User Database permissions:I used this link to set-up MSSQL Database:https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.SQLServer.htmlCloudWatch Logs from Full-load and CDC:2023-03-24T10:24:20 [SOURCE_CAPTURE  ]E:  SqlStat: Can't retrieve exception Information.  [1020102]  (sqlserver_log_processor.c:4218)2023-03-24T10:24:20 [SOURCE_CAPTURE  ]E:  Unknown '0' native error detected while SQL_ERROR is flagged / SQLSTATE is not empty. [1020102]  (sqlserver_log_processor.c:4219)2023-03-24T10:24:20 [SOURCE_CAPTURE  ]E:  Encountered an unexpeceted error. [1020102]  (sqlserver_endpoint_capture.c:961)2023-03-24T10:24:20 [TASK_MANAGER    ]D:  Stream component failed at subtask 0, component st_0_FJEVKYXUXT4EL37EIZLPUSAOLI5SQIWJICONNJQ [1020102]  (subtask.c:1414)2023-03-24T10:24:20 [SOURCE_CAPTURE  ]E:  Error executing source loop [1020102]  (streamcomponent.c:1873)2023-03-24T10:24:20 [TASK_MANAGER    ]D:  Error executing source loop; Stream component failed at subtask 0, component st_0_FJEVKYXUXT4EL37EIZLPUSAOLI5SQIWJICONNJQ; Stream component 'st_0_FJEVKYXUXT4EL37EIZLPUSAOLI5SQIWJICONNJQ' terminated [1020102]  (replicationtask.c:2891)CloudWatch Logs from CDC only:Set up MS-CDC Replication for tables Setting/ECA 'setUpMsCdcForTables' is DisabledPositioning token value upon start is: 'timestamp:2023-03-27T09:05:37'Querying for 1st LSN matching timestamp '2023-03-27T09:05:37' on physical device '(null)', at position 0. Please wait as this may take some time.2023-03-27T13:41:32 [SOURCE_CAPTURE  ]E:  Failed (retcode -1) to execute statement [1022502]  (ar_odbc_stmt.c:2732)2023-03-27T13:41:32 [SOURCE_CAPTURE  ]E:  RetCode: SQL_ERROR  SqlState: 42000 NativeError: 9005 Message: [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Invalid parameter passed to OpenRowset(DBLog, ...). Line: 1 Column: -1 [1022502]  (ar_odbc_stmt.c:2738)2023-03-27T13:41:32 [SOURCE_CAPTURE  ]E:  Failure in resolving stream position by TIMESTAMP [1020101]  (sqlserver_log_utils.c:2647)2023-03-27T13:41:32 [SOURCE_CAPTURE  ]E:  Failure in starting (with TXN consistency...) [1020101]  (sqlserver_endpoint_capture.c:495)2023-03-27T13:41:32 [TASK_MANAGER    ]D:  Stream component failed at subtask 0, component st_0_FJEVKYXUXT4EL37EIZLPUSAOLI5SQIWJICONNJQ [1020101]  (subtask.c:1414)2023-03-27T13:41:32 [SOURCE_CAPTURE  ]E:  Error executing source loop [1020101]  (streamcomponent.c:1873)Last Error Stream Component Fatal error. Task error notification received from subtask 0, thread 0 [reptask/replicationtask.c:2822] [1020101] Error executing source loop; Stream component failed at subtask 0, component st_0_FJEVKYXUXT4EL37EIZLPUSAOLI5SQIWJICONNJQ ; Stream component st_0_FJEVKYXUXT4EL37EIZLPUSAOLI5SQIWJICONNJQ' terminated [reptask/replicationtask.c:2829] [1020101] Stop Reason FATAL_ERROR Error Level FATALWhat I have tried:I have specified a LSN number for CDC start point. This was unsuccessful and provided the same logs seen above (cdc only).I have tried to set the "setUpMsCdcForTables" setting to "true" in my task_settings.json file but this is not possible through Terraform apply or manually available on the console. I enabled this manually on the db/table.According to documentation*"AWS DMS version 3.4.7 and greater can set up MS CDC for your database and all of your tables automatically if you aren't using a read-only replica. To use this feature, set the SetUpMsCdcForTables ECA to true. For information about ECAs, see Endpoint settings." *This does not prove true in my case.Followed Microsoft documentation:https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sys-sp-cdc-enable-db-transact-sql?view=sql-server-ver16Followed AWS workshop for Microsoft SQL Server to Amazon S3:https://catalog.us-east-1.prod.workshops.aws/workshops/77bdff4f-2d9e-4d68-99ba-248ea95b3aca/en-US/sqlserver-s3What I do not understandQuerying for 1st LSN matching timestamp '2023-03-27T09:05:37' on physical device '(null)', at position 0. Please wait as this may take some time.The physical device = null, if this means that the transaction logs for the MSSQL database cannot be accessed, and why this is the case.2023-03-27T13:41:32 [SOURCE_CAPTURE  ]E:  RetCode: SQL_ERROR  SqlState: 42000 NativeError: 9005 Message: [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Invalid parameter passed to OpenRowset(DBLog, ...). Line: 1 Column: -1 [1022502]  (ar_odbc_stmt.c:2738)Invalid parameter, I am guessing, is due to the error shown before (physical device).Why this is not succeeding?Please adviseFollowComment"

Answer: "0setUpMsCdcForTables should not be set in task settings but on the endpoint  extra connection attributes.select Source endpoint as the endpoint type. Enter a name for the endpoint and choose Microsoft SQL Server for Source engine. Enter the connection details, expand Endpoint settings, select Use endpoint connection attributes, and add the following extra connection attributes:setUpMsCdcForTables=trueCommentSharerePost-srikarkranswered a month ago"


Question: NoSQL Workbench Feature Request: Collapsible Visualizer UI

Can you please make the column of UI that displays the Visualizer collapsible?  That way more of the Aggregate view will be visible on the screen without scrolling.FollowComment

Answer: "1Thank you again for providing your feedback, I will pass this along to the NoSQL Workbench team for their consideration.You can also reach out to the team directly by using the Email us button on the left column of the NoSQL Workbench UI.CommentShareEXPERTLeeroy Hannigananswered a year ago0Hello,The NoSQL Workbench team would love to hear your feedback and your experience with NoSQL Workbench. Would you be open to chatting with the team?CommentShareccole-awsanswered 5 months ago"


Question: Can't change endpoint url

"I'm using SES since few months ago and using SNS the same timeNow, I want to change a SNS subscription so the Endpoint uses another url (in the same domain) but can't found an option to do thatAlready changed webhooks for Apple, Paypal and Openpay (bank payments)Edited by: sunco007 on Mar 1, 2021 2:17 PMFollowComment"

Answer: 0I created a new webhook setting and deleted the old one. I did not know that the RNA could continue to be usedCommentSharesunco007answered 2 years ago


Question: Cognito policy for accessing IoT things

"Here's what happens in my application...I have a Node JS web application that displays an HTML page with live device information on.A user logs in using Open ID Connect (using Cognito).I use the user's identity token to get their identity that has an IoT policy attached to it.All of this works so far up until I start using a Condition in the IoT policy associated with the user.I want a user to only access a 'Thing' if the user's organization and Thing's organization match. I create a unique IoT policy for each user and attach it to the user's cognito identity.Here's my security policy. Again this is the policy that's attached to the user's identity. I should point out that if I remove the 'Condition' everything works...{  "Version": "2012-10-17",  "Statement": [    {      "Action": [        "iot:Connect"      ],      "Effect": "Allow",      "Resource": "arn:aws:iot:us-east-1:1234567890:client/*"    },    {      "Action": [        "iot:Publish",        "iot:Receive"      ],      "Effect": "Allow",      "Resource": "arn:aws:iot:us-east-1:1234567890:topic/*",      "Condition": {        "StringEquals": {          "iot:Connection.Thing.Attributes[org]": "acme"        }      }    },    {      "Action": [        "iot:Subscribe"      ],      "Effect": "Allow",      "Resource": "arn:aws:iot:us-east-1:1234567890:topicfilter/device/*"    }  ]}What am I doing wrong? Why is this not working? The Thing definitely has an 'org' attribute on it. Please don't tell me the condition is being somehow applied to the user rather than the thing the user is trying to connect too :(.Edited by: gemehendrix on Jan 9, 2019 7:26 AMFollowComment"

Answer: "0Ok I've found the AttachThingPrincipal API where I can attach a cognito identity to a Thing. The Thing's name will then be used accordingly.In order to achieve what I need to organization wise, I'll probably just need to rework the format of the topics.Any further suggestions are welcome.CommentSharegemehendrixanswered 4 years ago"


Question: Docker containers - connection refused

"I have a task running 3 containers (for testing purposes). I have left the network as default, they are all in the same task definition.2 of them are gunicorn servers running on ports 5000 and 80, respectively. The third needs to communicate with those 2.I have been searching and trying for hours, but I keep getting "connection refused" when trying to communicate from the third docker to any of the other 2.Details:They are all in the same task definition.Ports 80, 5000 are exposed with the correct mapping in the task definitionNetwork mode was left as default (also tried bridge)The configuration works fine on my local machine with a bridge networkIs there anything I am missing?FollowComment"

Answer: "0When running multiple containers, you can use  the container's name as the hostname to communicate between the containers.However, make sure the following:Ensure that your containers have unique names in the task definition. You can use these names as hostnames for inter-container communication.Use  container name as the hostname: When trying to connect to another container within the same task definition, use  <container_name>:<port> as the target address. For example, if you want to connect to the container running on port 5000, use <container_name>:5000.Ensure that your gunicorn servers are binding to 0.0.0.0 instead of 127.0.0.1. Binding to 0.0.0.0 allows connections from all network interfaces, while binding to 127.0.0.1 only allows connections from the same container. You can bind to 0.0.0.0 using the following command:gunicorn -w 4 -b 0.0.0.0:5000 app:appIf your containers are running in an Amazon ECS environment, verify that the security groups associated with your task allow incoming traffic on ports 80 and 5000.Check the logs of your gunicorn servers and the third container to identify any configuration issues or error messages that could indicate the cause of the connection problem.CommentShareEXPERTsedat_salmananswered 2 months ago"


Question: AWS CloudWatch agent configuration

"Looking through the AWS CloudWatch Agent repo on github, I've noticed two configuration options under the file section:Regular expression for log files to ignoreblacklist = "journal|syslog"Publish all log files that match file_pathpublish_multi_logs = trueI would like to use those, but I'm concerned that these might be removed later on. Anyone out there using/knowing more about these?ThanksLink to the github repo:https://github.com/aws/amazon-cloudwatch-agent/blob/39d84b8e3f5215a3e6d880b54a88e63a692ecd64/plugins/inputs/logfile/README.mdLink to the documentation:https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.htmlFollowComment"

Answer: "0Accepted AnswerThe Link to the github repo:https://github.com/aws/amazon-cloudwatch-agent/blob/39d84b8e3f5215a3e6d880b54a88e63a692ecd64/plugins/inputs/logfile/README.mdIs considered an open source for features you can use for the Cloudwatch Agent, as I have tested in my environment you should be able to exclude files using blacklist = "journal|syslog" and put logs from each log file in a separate log stream using  publish_multi_logs = true.As far as my knowledge this should not be disabled or removed, if you face any issues in the future regarding this feature reach AWS support.CommentShareAbboudanswered 2 years ago"


Question: BadRequestException in MediaLive Input Update

I'm getting "An error occurred (BadRequestException) when calling the UpdateInput operation: You must specify a MediaConnect Flow Arn." while updating mediaLive inputs using boto3.FollowComment

Answer: "0Can you please provide more information on what actions you are doing when you see this? Are you editing an existing MediaLive input, or trying to create a new MediaLive input? What Input Type?Can you share your a snippet of your code?CommentShareAWS-User-5437070answered 4 years ago0import jsonimport boto3client = boto3.client('medialive',region_name="eu-central-1",aws_access_key_id="XXXX",aws_secret_access_key="XXXXXXXXX")response = client.update_input(Destinations=[{  },],InputId='xxxxx',InputSecurityGroups=[],MediaConnectFlows=[{},],Name='vod',RoleArn='arn:aws:medialive:eu-central-1:XXXXX:input:XXXX',Sources=[{'Url': 'https://xxxxx/xxxxxxx_TVC_16x9.mp4'},])i want to change input source in medialive. type is MP4_FILE.CommentSharelalanianswered 4 years ago0solvedI removed all unwanted fields like MediaConnectFlow,RoleArnThanksCommentSharelalanianswered 4 years ago"


Question: "Saving Plan Showing as underused, but still being charged on-demand usage."

"Hi there!On Dec 1st I submitted a purchase for a savings plan which should cover m5 family ec2 instance usage on us-east-1 region. I made the calculations to cover roughly what I was planning to use, but when looking at the billing details, it shows it only covered around %40 of the actual usage; but again, when looking at the saving plans usage, it shows only %54 of it was used. I couldn't figure out why all the usage wasn't being applied agaisnt the savings plan.The instance usage I intended to cover with this plan was a m5.2xlarge running Windows with SQL Enterprise. (The only m5 instance I'm actively using in this region)Unfortunatelly I can't post screenshots, but my m5 coverage report on us-east-1 region shows 44% coverage, but on the other hand my Saving plan utilization report shows only 54% usage.Thanks!!FollowCommentMichael_K a year agoWhat rate did you purchase? Which payment option? No Upfront, Partial, All?Was it compute or ec2 instance savings plan?Share"

Answer: "1Accepted AnswerThe most likely reason is that your instance that is supposed to match attributes of your Savings Plan is not running 24/7. And also, during some hours you may be running more instances than you have Savings Plans.Billing works hourly. Let's say you purchased Savings Plans for 1yr term. You are committing to pay for the full term and the full price for that Savings Plan. If you are running matching instances, and your SP applies to them, then you will not get on-demand charges for those instances, but will essentially only pay for SP.Because billing works hourly, generally you need to check your hourly utilization. Let's assume you purchsed SP based on the assumption that you would run 2 instances 24/7:Let's say you purchase SP based on the calculation of the total number of hours you run your M5 instances in a month.But let's say you always run 3 instances between 12:00 and 00:00. And then you run only 1 instance between 00:00 and 12:00. On average you run 2 instances throughout the whole day.In this example, between 12:00 and 00:00 you will get 100% utilization of your SP, but you will also get extra on-demand charges for an extra running instance. But between 00:00 and 12:00 you will only have 50% utilization of your SP, and no on-demand charges.I hope this helps.CommentShareEXPERTNataliya_Ganswered a year agoMatt a year agoThanks Nataliya, I reviewed your example, and in fact I wasn't aware that hourly usage was not added up and could be distributed across different days if instances where not running 24/7. So basically, I made a mistake on the calculations based on the concept not being clear for me. I'll try to ask AWS support for a cancelation on the savings plan, I know there are some occasions where if the contract is purchased by mistake there could be a one-time courtesy cancellation; so, wish me luck!!:)Regards!Share"


Question: Can I use SSM Automation runbook with awscli or something different?

"I need to make SSM Automation runbook and this runbook needs to run aws command (aws s3 cp s3:// s3:// --recursive --include --exclude), but I don't need to install Install-Module AWS.Tools.S3 -Force, because this module don't have --exclude and --include parameters. How can I resolve this issue?FollowComment"

Answer: 0Resolved! ThanksCommentShareYuriianswered 10 months ago


Question: bucket is missing object lock configuration

what does this message mean? i have not enabled object lock. i have tried to give read access to a bucket to someone and they can list the keys but get this message when try to download.FollowComment

Answer: 0I'm having this same issue.  Did you figure it out?CommentSharerecvdanswered 4 years ago0Give that person also this permission:"s3:GetBucketObjectLockConfiguration"CommentSharecolferanswered 4 years ago


Question: export and import security group rules

"We have a big ugly mess with the rules for a particular group of servers. I'd like to export them, edit them and import them again.  I was successful in exporting the rules as a CSV, though the import is a bit flawed, but I can't find any way to import them again. Am I missing something or was this a one-way operation?Failing this, can I dump the rules in one group as, for instance, json or yaml, or even xml, edit them externally, and put them back?Please help me by telling me AWS CLI command names, console operations, or whatever is available. I'm perfectly willing to read and research, but I haven't found a starting point.FollowComment"

Answer: "1Accepted AnswerHello,Exporting Security Groups through the management console is primarily a tool that could be used to perform manual audits, as it sounds like is the case here.For export/import functionality, I would also recommend using the AWS CLI or API. If using the CLI, we can use the aws ec2 describe-security-group-rules command to provide a listing of all rules of a particular group, with output in JSON format (see example).aws ec2 describe-security-group-rules --filter Name="group-id",Values="sg-0a53fe4abed0bb1e6"{    "SecurityGroupRules": [        {            "SecurityGroupRuleId": "sgr-0c6a87099ccb11a83",            "GroupId": "sg-0a53fe4abed0bb1e6",            "GroupOwnerId": "aws_account_number",            "IsEgress": true,            "IpProtocol": "-1",            "FromPort": -1,            "ToPort": -1,            "CidrIpv4": "0.0.0.0/0",            "Tags": []        },        {            "SecurityGroupRuleId": "sgr-013f9801176513efb",            "GroupId": "sg-0a53fe4abed0bb1e6",            "GroupOwnerId": "aws_account_number",            "IsEgress": false,            "IpProtocol": "tcp",            "FromPort": 22,            "ToPort": 22,            "CidrIpv4": "0.0.0.0/0",            "Description": "Allow SSH",            "Tags": []        }    ]}Now let's say that we want to add an additional ingress rule to this group, in which case we can use the aws ec2 authorize-security-group-ingress command to insert a rule into a group.aws ec2 authorize-security-group-ingress --group-id sg-0a53fe4abed0bb1e6 --protocol tcp --port 80 --cidr 0.0.0.0/0{    "Return": true,    "SecurityGroupRules": [        {            "SecurityGroupRuleId": "sgr-0ff1df36f6377d6eb",            "GroupId": "sg-0a53fe4abed0bb1e6",            "GroupOwnerId": "aws_account_number",            "IsEgress": false,            "IpProtocol": "tcp",            "FromPort": 80,            "ToPort": 80,            "CidrIpv4": "0.0.0.0/0"        }    ]}Now we can again return to use the aws ec2 describe-security-group-rules command to verify the complete group configuration.aws ec2 describe-security-group-rules --filter Name="group-id",Values="sg-0a53fe4abed0bb1e6"{    "SecurityGroupRules": [        {            "SecurityGroupRuleId": "sgr-0c6a87099ccb11a83",            "GroupId": "sg-0a53fe4abed0bb1e6",            "GroupOwnerId": "aws_account_number",            "IsEgress": true,            "IpProtocol": "-1",            "FromPort": -1,            "ToPort": -1,            "CidrIpv4": "0.0.0.0/0",            "Tags": []        },        {            "SecurityGroupRuleId": "sgr-0ff1df36f6377d6eb",            "GroupId": "sg-0a53fe4abed0bb1e6",            "GroupOwnerId": "aws_account_number",            "IsEgress": false,            "IpProtocol": "tcp",            "FromPort": 80,            "ToPort": 80,            "CidrIpv4": "0.0.0.0/0",            "Tags": []        },        {            "SecurityGroupRuleId": "sgr-013f9801176513efb",            "GroupId": "sg-0a53fe4abed0bb1e6",            "GroupOwnerId": "aws_account_number",            "IsEgress": false,            "IpProtocol": "tcp",            "FromPort": 22,            "ToPort": 22,            "CidrIpv4": "0.0.0.0/0",            "Description": "Allow SSH",            "Tags": []        }    ]}AWS CLI Describe Security Group Rules https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-security-group-rules.htmlAWS CLI Authorize Security Group Ingress https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/authorize-security-group-ingress.htmlAlso, if ongoing validation and remediation of security group configuration is of concern, I would suggest investigating AWS Firewall Manager as you can use it to build security group policies for audit/enforcement/remediation of security group configurations.https://docs.aws.amazon.com/waf/latest/developerguide/security-group-policies.htmlCommentShareDarren Ranswered 3 months agoEXPERTBrettski-AWSreviewed 3 months ago"


Question: How to import/share a lib/class between component in ggv2

"Hi there,I am just wondering is there a way that I can reuse my code between the component, kind of like lambda layereg:foo-- src---- send_mqttfoo2-- src---- send_mqttSo how can i use request the send_mqtt ?Thanks for your helpFollowComment"

Answer: "0Accepted AnswerHi,you could create a component which deploys send_mqtt. Then you create your foo and foo2 components with a dependency to send_mqtt.A particular recipes example could look like:send_mqtt{  "RecipeFormatVersion": "2020-01-25",  "ComponentName": "my.send_mqtt",  "ComponentVersion": "1.0.0",  "ComponentDescription": "Send messages via MQTT",  "ComponentPublisher": "Myself",  "Manifests": [    {      "Platform": {        "os": "linux"      },      "Lifecycle": {        "Install": "pip3 install --user -r {artifacts:decompressedPath}/send_mqtt/requirements.txt"      },      "Artifacts": [        {          "URI": "s3://MY_BUCKET/my.send_mqtt/1.0.0/send_mqtt.zip",          "Unarchive": "ZIP"        }      ]    }  ]}foo recipe{  "RecipeFormatVersion": "2020-01-25",  "ComponentName": "my.foo",  "ComponentVersion": "1.0.0",  "ComponentDescription": "Foo",  "ComponentPublisher": "Myself",  "ComponentDependencies": {    "my.send_mqtt": {      "VersionRequirement": "^1.0.0"    }  },  "Manifests": [    {      "Platform": {        "os": "linux"      },      "Lifecycle": {        "Run": "export PYTHONPATH=$PYTHONPATH:{my.send_mqtt:artifacts:decompressedPath}/send_mqtt; python3 {artifacts:path}/foo.py"      },      "Artifacts": [        {          "URI": "s3://MY_BUCKET/my.foo/1.0.0/foo.py"        }      ]    }  ]}In foo.py you can then import send_mqtt.KR,PhilippCommentSharePhilipp Sanswered a year agoAWS-User-6797102 a year agoThis is great help, thanks a lotShare"


Question: Cannot delete VPC due undeletable ENIs

"I'm having trouble deleting a VPC I no longer need.The VPC was originally created through cloudformation for an EKS cluster. When I was done with that cluster I deleted the stack(s) and the cluster, but there are still some resources left over:VPC itself2 subnets, route-tables, security groups,2 ENIsIt seems that the ENIs are the issue, all the other resources point to those and say I need to remove these first. But even with my root account credentials an attempt to detach these ENIs gives: "You do not have permission to access the specified resource."FollowComment"

Answer: "0Hello ronnyroe,I have checked your AWS Account and I could see from CloudTrail that you were trying to detach 2 ENIs recently. However the operations failed with the error "You do not have permission to access the specified resource.". As you haven't provided the ENI id I am assuming that these are the 2 resources in question.The 2 ENIs belong to your AWS Elastic Load Balancers (ELB) [1]. If you wish to delete the ENIs you need to first delete the related ELBs [2].I hope that you find this information helpful. Please let us know if you need any further help.Links:[1] https://aws.amazon.com/elasticloadbalancing/[2] https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-getting-started.html#delete-load-balancerRegards,awstomasCommentShareAWS-User-3892169answered 4 years ago"


Question: "Ingesting data from external sources like Git, Slack, Zoom, Instagram, 3rd party systems"

"ProblemI want to know, understand and correct my knowledge, approach on, Setting up an Data Ingestion pipeline, which collects "events" or "data" from any possible external application sources (applications of 3rd party)The rate of ingestion can be about 5000 (5K) events per day (normal) on peak it can go slightly more 20KApproach I been thinking aboutI am planning to setup AWS Lambda endpoint to which external systems can post(HTTP POST) the data, which then can load into OpenSearch to form a Data LakeThe ingestion pipeline operates between Lambda and OpenSearch, to performParsing of dataFetch more data if needed, by making API callsProcess, transform, enrichPost to OpenSearch Indices as per indicesI have been googling and exploring on AWS but so far can't find any thing which can validate above. Hence request you experts to comment, suggest and direct me to a practical solutionFollowComment"

Answer: "0Hi,Based on the ingestion rates, I think that the architecture you envisioned should work well.It is a variant of this pattern , the difference is that you use the Lambda to load Opensearch and not to trigger a search.The other pattern you could consider is to use API Gateway as a proxy to Amazon Kinesis Firehose (please, note the tutorial is for Kinesis Streams, and was only meant as a source of inspiration), and then use Firehose to transform the data (it will still uses Lambda functions for the transformations) and then deliver the data directly to OpenSearch.Some information additional information on this can beCommentShareEXPERTFabrizio@AWSanswered a year agoBAS a year agoThanks for your responseI am not able to see a ingestion pipeline other than Kinesis basedI feel Kinesis is a overkill for me, as I will not be having continuous real time data flowing, it can be busts of events.Hence trying to see, if any lighter stuff for processing (can event MQ based lambda or a pipeline) in AWS, else I guess myself have to setup a always On pipeline serviceShare"


Question: Delivery status notification(Failure)

"Hello,I have tried configuring AWS Lambda Function for Sending an Email with AWS SES and i keep getting an error (An error occurred while trying to deliver the mail to the following recipients) after i have verified the email. kindly help me with possible course.FollowComment"

Answer: "0Hey, Good Day!Here is the Lambda code which I have developed to sending an email using AWS SES. Kindly refer and revert.Thank youCommentShareNarasimha R Dugguanswered a year ago"


Question: Send Message to a Pinpoint Custom Channel

"I have setup a Pinpoint custom channel Lambda (as per the Pinpoint documentation). I'd like to use this custom channel to send messages to Slack groups. What approaches are available to send a message to my custom Slack channel?I can only find one approach based on this AWS Pinpoint documentation:"The MessageConfiguration object in the campaign must also contain a CustomMessage object. This object has one member, Data. The value of Data is a JSON string that contains the message payload that you want to send to the custom channel."My interpretation of this is:a. Use the API to create a new campaign and use the MessageConfiguration.CustomMessage.Data property.b. Edit an existing campaign and set the MessageConfiguration.CustomMessage.Data property.The Pinpoint AWS Console doesn't allow adding a message to a custom channel campaign.The Pinpoint SendMessages API doesn't seem to support sending to a custom channel.FollowComment"

Answer: "1There are a couple of custom channel examples like this but they all hard code the message. For example, the above sample contains this code:"""Construct your message here.  You have access to the endpoint profile to personalize the message with Attributes.`message = "Hello {name}!".format(name=endpoint_profile["Attributes"]["FirstName"])`"""message = 'Hello World! - Pinpoint Slack Channel'I was expecting a custom channel to behave like any other channel. The docs state:"Custom channels in Amazon Pinpoint allow you to send messages through any service that has an API, including third-party services."CommentShareAWS-User-4975744answered a year ago0Hello there. That's indeed a very interesting use case. Have you had the chance to look at this resource https://github.com/aws-samples/amazon-pinpoint-slack-channel please?CommentShareGeorgios Goniotakisanswered a year ago0I second this functionality. It makes very little sense that custom channels are not "1st class citizens" of pinpoint in the sense that you can't use the email template builder or SMS builder UI.What if you already have the sending infrastructure in place (SMS Gateways & SMTP MTAs/relays) and just want to use pinpoint for campaigns and user engagement? Custom channels seem like the right tool to do the job until you find out that you can't actually define your own messages.CommentSharemvanswered 10 months ago"