Question: Why publisher need Key Permission to use SSE-KMS SQS

"Why publisher need Key Permission to use server side encrypted (SSE-KMS) SQS? I understand SQS use client role to fetch key details from KMS and that’s why publisher need required key permission.  However, it’s not intuitive for client to have key permission in case SSE. So, what is the reason for this?One reason for this could to secure keys from SQS as a service. However, in case the publisher is another AWS service like EventBridge or SNS then that service has the access to Key. So, it's still confusing.FollowComment"

Answer: "0Hi!Some AWS services are what is often referred to as "instance-based" where the compute unit (for lack of a better word, but it could be an instance or container or something like Lambda) is executed on behalf of one account; there you can assign an execution role and assign permissions to that, the compute unit has it's own identity so to say.Other services like SQS do not have their own customer-controlled execution roles; they this identity and therefore rely on the caller's identity: the signed request is validated and as part of that validation, the caller's identity is determined. The service can then request a set of temporary credentials which it can use for the duration to make a request (from a pre-determined, tightly regulated list of actions) towards other services, which will then in turn validate if the caller is allowed to take that action. This makes it possible for the services to work without having to run with very high privileges and protects customer data.So when Alice send a message to an SQS queue which has been configured to use KMS key KeyA, she will need to use a recent version of the SDK which supports Signature V4 (or in some fashion ensure that her request has a SigV4 signature), and SQS will first use IAM to establish if Alice has permission to send to the queue. If she has, the compute unit will see if it has a valid DataKey for this queue in the cache. If it has one then it will use it but if not, the compute unit will contact KMS on Alice's behalf and obtain a new DataKey. Now the DataKey is available, the message payload will be encrypted with the DataKey and stored in the queue together with the DataKey encrypted by KMS key KeyA.For Bob to be able to recieve the message, he will need to use a SigV4-signed request which will be validated to see if he is allowed to receive from the queue. If he is, then the compute unit will look at the message and compare it's cached keys with the KeyID of the DataKey used to decrypt the message. If the DataKey isn't cached, then SQS will contact KMS on behalf of Bob and ask for the DataKey to be encrypted. The compute unit can now decrypt the payload and Bob can finally read what Alice sent to the queue.Hope this helps to clarify.with kind regards,Bent TCommentShareBent_Tanswered a year ago"


Question: Manual Approval Workflow for AppStream File Download to Local

"Hi Friends,My Project Team is onboarding AppStream 2.0.We would like to implement some sort of manual approval workflow for Users to seek permission in downloading files from AppStream 2.0 to their Local PCs.i.e. User need to put up a request to download files from AppStream for approval to designated Officers.User can only download if the request is approved (turnaround may be in days).Is there any sample implementations/tutorial for this?TIA~FollowComment"

Answer: "0Hello there,There is no mechanism within the Appstream service related to your use case. Also, you mentioned that approval can take days, so by the time you approve the request, the session may be terminated. Unless your files are saved in persistent storage, everything will be wiped off from the instance and it will be terminated since Appstream uses non persistent desktops.CommentShareMayank_Janswered 6 months ago"


Question: DMS : Source RDS : Last Error Error 1236 reading binary log.

"While using DMS to transfer data from MySQL RDS to S3, this error comes (not frequently, only monthly), and cdc task gets stopped.Last Error Error 1236 reading binary log. Task error notification received from subtask 0, thread 0 [reptask/replicationtask.c:2880] [1020493] Error executing source loop; Stream component failed at subtask 0, component st_...; Stream component 'st_...' terminated [reptask/replicationtask.c:2888] [1020493] Stop Reason FATAL_ERROR Error Level FATALCan someone help, when I restart the cdc task it is normal again, but when i choose to resume it gives same error.Also : In cloudwatch metrics I can see CDC latency source : and there is a spike on same time of error and in source RDS cloudwatch also there is spike on Read IOPS.FollowCommentrePost-User-9883228 8 months agoLast Error Error 1236 reading binary log. Task error notification received from subtask 0, thread 0 [reptask/replicationtask.c:2880] [1020493] Error executing source loop; Stream component failed at subtask 0, component st_0_WD5U7BSFYILYXESHRTVIQR7CPX5E7X5DGTUGQ7Q; Stream component 'st_0_WD5U7BSFYILYXESHRTVIQR7CPX5E7X5DGTUGQ7Q' terminated [reptask/replicationtask.c:2888] [1020493] Stop Reason FATAL_ERROR Error Level FATALStartedJune 27, 2022, 13:10:19 (UTC+05:30)Share"


Question: Nested virtualization on Graviton

HiI am hoping to spin up an Arm QEMU based VM on a Graviton EC2 instance. Given that there is already the AWS hypervisor layer (I assume) do I need to do anything special to get my VM to leverage KVM? Is there any specifics on this on the support site somewhere?Thanks!StephenFollowComment

Answer: "1Thanks for your interest in Graviton instances!Graviton 2 uses the ARMv8.2 architecture, which does not have native support for nested virtualization, which is added in ARMv8.3. See https://developer.arm.com/architectures/learn-the-architecture/aarch64-virtualization/nested-virtualization for more information. You can, however, use any of the Graviton metal instance types to do what you want to. AWS offers a metal instance with 64 Graviton 2 cores in the C, M, and R instances families.Feel free to post again if you have follow up questions.JonathanEdited by: JonathanForAWS on Oct 13, 2020 2:18 PMCommentShareAWSjswinneyanswered 3 years ago0Thanks JonathanThat's a pretty awesome explaination. I did not know Graviton 2 was based ARMv8.2. Now I am very excited for Graviton 3 ;-).I can't do what I want to do on bare-metal Graviton as I need to emulate an NVMe SSD with a CMB inside QEMU/libvirt to do some p2pdma Linux kernel testing for ARM platforms. The NVMe drives you emulate on these instances via Nitro don't support the CMB feature and the virtualization Nitro provides messes with the experiments I want to perform.I did get emulated QEMU to work on the Graviton 2 but it is (as you might imagine) stupid slow. Using a real ARM CPU to run an emulation of a ARM CPU is not efficient ;-). I do have some real Arm based systems in my lab (based on Mellanox and Broadcom ARM SoCs) and will see if I can setup a bare-metal system with what I need on them.StephenCommentSharesbates-nvmeanswered 3 years ago"


Question: Redshift is translating 'dbo' schema name in to 'public' schema name.

"We have two Redshift clusters. One cluster updated to version 1.0.44126 over the weekend. After that, we started experiencing failures in some data extract processes. The error was:ERROR: schema "dbo" does not existSure enough, after reviewing the queries we had inadvertently used dbo instead of public in the schema name. However, it worked for months prior to this latest Redshift version. I cannot find any information on version 1.0.44126. I cannot find any feature that might translate these schema names transparently.Why is Redshift doing this?I can reproduce the behavior on cluster version 1.0.43931.create table public.test_table ( test integer );select * from dbo.test_table;drop table dbo.test_table;The above all succeeds on cluster version 1.0.43931 and fails on 1.0.44126.FollowComment"

Answer: 0I just tested with 1.0.44903 and your test case appears to work again. I highly recommend you do not continue the practice of using "dbo" as a synonym for "public". This appears to be an undocumented feature which could be removed again in the future.CommentShareEXPERTjgrcloudanswered 5 months ago


Question: Error while uploading to s3 from elastic beanstalk

same problem stated on this threadhttps://repost.aws/questions/QUDpuRoadAQHK9g9kpnzcuGg/cant-upload-to-elastic-beanstalkunfortunately turning off CSP did not work for me as stated in the thread. any other suggestions?FollowComment


Question: CDK - how to set OpenSearch/Elasticsearch as the destination of a Kinesis Firehose?

"I am trying to create Data Stream -> Firehose -> OpenSearch infrastructure using the AWS CDK v2.In my CDK Stack I have created an OpenSearch Domain, and am trying to create a Kinesis Firehose DeliveryStream with that domain as the destination. However, kinesisfirehose-destinations package seems to only have a ready-to-use construct for S3 buckets, so there is no obvious way to do this easily.I have tried implementing my own IDestination, but I am at a complete loss since I have no idea how to implement bind.So, my questions are:How are you supposed to implement bind in IDestination?Are there any complete working examples of creating a Firehose to OpenSearch using the non-alpha L1 constructs?FollowComment"

Answer: "0Hi, I would like to share my repository: https://github.com/aws-samples/aws-iot-greengrass-v2-using-aws-cdk.In here, I am passing data from Firehorse to ES using CDK ver1 with L1 Construct.https://github.com/aws-samples/aws-iot-greengrass-v2-using-aws-cdk/blob/main/infra/stack/data/data-pipeline-stack.tsBecause this code uses L1 construct(cdk v1) instead of alpha cdk v2, you can apply this code directly in your cdk ver2.CommentShareAWS-Kwonyulanswered a year ago"


Question: AWS IOT GreenGrass Device Shadow versioning

"Hi AWS community:I'm using AWS GreenGrass device shadow service to store some data, I'm interested in version history of device shadow so I could inspect data change over time, does device shadow service support such thing out of box?An alternative I'm exploring is finding out if device shadow supports any triggers so I can call lambda to record current device shadow document. (however I haven't found any documentations about this).Any advices are appreciated.Thank youFollowComment"

Answer: "1Accepted AnswerAt this time, there's no shadow history built into the service. You would need to create the history yourself by using AWS IoT Core Rules to process shadow document changes as they are published on Device Shadow MQTT topics.There is a Lambda rule action but it may be more cost effective to instead use the one of the other Rule actions to simply store each version of the shadow document. For instance, a DynamoDB rule action.CommentShareEXPERTGreg_Banswered a year ago"


Question: Amazon Athena experienced a permission error with Lambda

"When I try to execute an Athena query by a Lambda function,  I get the following error message:{"ErrorCategory":2,"ErrorType":1500,"Retryable":false,"ErrorMessage":"Amazon Athena experienced a permission error. Please provide proper permission and submitting the query again. If the issue reoccurs, contact AWS support for further assistance. You will not be charged for this query. We apologize for the inconvenience."}I added full permission for my lambda role:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor1",            "Effect": "Allow",            "Action": [                "s3:*"            ],            "Resource": [                "arn:aws:s3:::my-bucket/*",                "arn:aws:s3:::my-bucket"            ]        },        {            "Sid": "VisualEditor2",            "Effect": "Allow",            "Action": "athena:*",            "Resource": "*"        }    ]}With that lambda function, I could run the query successfully from my local.How can I find out which permission is missing when running AWS Lambda?FollowComment"

Answer: "1Hi,Please verify that you are using the correct lambda execution role.Please refer to the below articles for more information:https://aws.amazon.com/premiumsupport/knowledge-center/schedule-query-athena/https://docs.aws.amazon.com/athena/latest/ug/federated-query-iam-access.htmlhttps://docs.aws.amazon.com/quicksight/latest/user/troubleshoot-connect-athena.htmlCommentShareSUPPORT ENGINEERRishabh_Danswered 5 months agoEXPERTFabrizio@AWSreviewed 5 months agorePost-User-3071397 5 months agoThanks for your information. The issue has been resolved after adding below policy (when trigger athena.startQueryExecution(...), it will invoke a Athena's lambda connector):{"Version": "2012-10-17","Statement": [{"Sid": "VisualEditor0","Effect": "Allow","Action": ["lambda:InvokeFunction"],"Resource": ["arn:aws:lambda:us-west-2:accountID:function:test-datasource-connector"]}]}Share"


Question: Crowdstrike detection of malicious activity of Amazon SSM Agent for Windows

"I think a more secure SSM Agent for Windows needs to be developed.  Is there anything along these lines in the works?I installed the valid, digitally signed AmazonSSMAgentSetup on a Windows server in preparation to present AWS as a potential alternative to our current on-prem logging solution.  When opening up the Event Logs, Processes, or Performance info for this node in Fleet Manager, I get a Crowdstrike detection on the SessionManagerShell (winpty-agent.exe).  This component of the SSM agent is unsigned and it is performing actions which are not acceptable in a secure Windows environment.  This process downloads and executes a compressed, base64-encoded payload instead of using proper, code-signed powershell script.  It collects the log files successfully at first, but it also puts powershell into bypass and runs a series of "wevtutil cl" commands that clear various Windows Event, Powershell, and trace logs which I prefer to retain.  It's barbaric.  At that point, Crowdstrike (rightfully) blocks the process and it does not continue to function.FollowComment"

Answer: 1Accepted AnswerI recommend submitting the concern through the security vulnerability reporting form. Please see the Vulnerability Reporting page for more details.CommentShareTaka_Manswered 7 months ago


Question: Is it possible to use AWS RDS SQL Server as an AAG target from on premise primary?

Is it possible to use AWS RDS SQL Server as an AAG target from on premise primary?FollowComment

Answer: "2RDS SQL Server is a managed service, so it will not be possible to add RDS Instance as an extension node to your on-premise primary instance. However, you can connect directly from your on-premise App to hosted RDS SQL Server instance in AWS. Alternatively, if you need RDS as a DR node for your on-premises primary, you can use an option like DMS (Database Migration Service) to set up on-going replication to RDS.Ref: https://aws.amazon.com/blogs/database/cross-region-disaster-recovery-of-amazon-rds-for-sql-server/CommentShareRamanswered 2 years ago0While RDS SQL Server supports AlwaysOn Availability Group in AWS, this is not supported today with on-premises. Depending on your use case, you can deploy your SQL Server on EC2 in AWS cloud and with Distributed availability group. One availability group can be on premises, and the other availability group can be on the Amazon Web Services (AWS) Cloud on Amazon Elastic Compute Cloud (Amazon EC2) instances in a different domain.You can reference this prescriptive guidance for Migrating SQL Server to AWS using distributed availability groups for further information.https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/migrate-sql-server-to-aws-using-distributed-availability-groups.htmlCommentShareLarryBanswered 2 years ago0With Recent announcement of RDS Custom it is now possible to have an on-premise  Primary Replica and Secondary replica on RDS SQL Server. This may need to be adjusted once Multi-AZ is supported for RDS Custom for SQL ServerCommentShareRafetanswered a year ago"


Question: Syntax for simple text log filtering

"Hi guys.What is this search field called and how do I use it?There are what seem like a great many different ways to query logs in cloudwatch, but I can't figure out what syntax is meant to be applicable to this simple one-line search tool you see regularly during object inspection.  I haven't been able to work out how its special characters / pattern matching work through trial and error.  My logs are all just unformatted plain text in this case.FollowComment"

Answer: 0HiYou can search your log data using the Filter and pattern syntaxAlso it might be helpful to check out CloudWatch Logs Insights.  Here is a good workshop you can follow showing how to use CloudWatch Logs Insights with ECShttps://www.ecsworkshop.com/container_insights/logsinsights/CommentShareEXPERTMatt-Banswered 9 months ago


Question: Cannot upgrade EKS

"Hi,I have a EKS cluster with version 1.16 and try to update to 1.17 but failed with the following error due to missing default security group (deleted)2021-11-13 09:19:19 [ℹ] will upgrade cluster "xxx" control plane from current version "1.16" to "1.17"Error: InvalidRequestException: The security group 'sg-0fdxxx' does not exist (Service: AmazonEC2; Status Code: 400; Error Code: InvalidGroup.NotFound; Request ID: xxx-xxx-xxx-xxx-xxx; Proxy: null)There seems to be no other way to update it so I wait for the force updating from AWS when it comes to the end of support date. However, nothing has happened. So I would like to ask is there anyway to restore the old security group or remove the default one in the current cluster to allow updating or notThanksFollowComment"

Answer: "2If this was the control plane security group, I don't believe you can modify this and you won't be able to re-create the security group ID. Your best option at this point is to rebuild the cluster.Please also see: https://github.com/aws/containers-roadmap/issues/738CommentShareEXPERTRob_Hanswered a year ago0Yes, I saw that issue long time ago. However, my cluster here is production one and it will take more effort to rebuild and migrate all the things there.I'm also wondering why the force update does not happen. At least, I can try to schedule downtime for thisCommentShareplavanswered a year ago"


Question: Account Blocked

"Hi team,Am using a free tier account. When I try to create an EC2 instance, it shows an error message as my account is blocked. How can I unblock my account. Contacted the Aws support team 2 days ago but still am facing the same problem.Can anyone help me to solve this issue.FollowComment"

Answer: "0Hello,The best thing you can do is to wait for the aws support to answer.Unfortunatly it can take a few days but normally they are very fast imo.SincerelyHeikoCommentShareHeikoMRanswered 6 months ago0Hello,I'm sorry about any frustration or concern this has caused. Thanks for reaching out to our Support team for one on one guidance. I can assure you, the team handling your case has the visibility needed to take a closer look. For secure guidance, please continue to follow up on your support correspondence. I appreciate your patience while our team with the required tools continues to investigate.Thank you,- AWS Support - JohnCommentShareEXPERTAWS Support - Johnanswered 6 months ago"


Question: Determine source of message in DLQ

"We are looking at ways of unifying our DLQ handling but a problem we are facing an issue with identification of the actual source. Our current approach is to have a unique DLQ for each lambda or similar (could be sns, scheduler, etc.) and then have a lambda with the DLQ as source which further processes the failed messages (could be automatic retries, storing in Dynamo for manual handling, etc.). But we think this becomes a bit cumbersome since we will quickly incur quite high fees for the polling (we have a lot of places where we need DLQs).Our absolute dream scenario is if we could set a tag where we add the DLQ but this isn't available. An alternative would be to use the SenderID in the SQS message to identify the source but this doesn't really seem possible.Anyone have any suggestions?FollowComment"

Answer: "0One potential solution for identifying the source of a message in a DLQ could be to include metadata in the original message that identifies the source. This could be done by adding a custom header or a JSON field to the message that includes information about the source. This metadata could then be used to determine the source of the message when it ends up in the DLQ. Another potential solution is to use the SNS topic ARN as a way to identify the source, since it will be included in the SQS message when it's delivered to the DLQ. Additionally, you could also use CloudWatch Logs to trace the source of the message.CommentShareVictor van Liederenanswered 5 months agoLewenhaupt-Invoier 5 months agoYeah we can determine the source of an Eventbridge event via the actual source. But that doesn't tell us which lambda was the reason it got put in the DLQ. We could of course add some info to the exception that helps us determine that further, but that only works for exceptions origination from our code, not oom issues or similar.Eventbridge scheduler for example adds a lot of useful metadata when it puts items on its DLQ but the same doesn't go for Lambdas. The only useful additional metadata is the RequestId, but that is only useful for finding the execution if you already know the lambda.Yeah we thought about the SNS Topic ARN, but seeing as we can't push from SQS to SNS without having a lambda in between that doesn't solve the solution. It does work when we use Lambda destinations though, but not in other scenarios.ShareLewenhaupt-Invoier 5 months agoI've just realised that we get a lot more info if we use the DLQ as a Lambda Destination instead of directly as a DLQ.Share"


Question: cognito hosted ui logout failing with

"HelloI have a test web application with cognito hosted UI.  The login part works well and I can reach my index.html page after authenticating with cognito.  when i try to logout following the documentation for cognito it just saysGET  https://myDomain.auth.REGION.amazoncognito.com/logout?client_id=MyClientID&redirect_uri=https://www.cnn.com&response_type=codewhen I do that, I get an error on chrome developer tools, that saysAccess to XMLHttpRequest at 'https://myCognito.auth.REGION.amazoncognito.com/logout?client_id=MyClientID&redirect_uri=https%3A%2F%2Fwww.cnn.com&response_type=code' from origin 'https://myDomain.REGION.amazonaws.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.how do I make sure the browser wont stop the logout request? as I recall cognito does not have any place were to configure CORSis there any other way to do a logout request?thanksRTFollowCommentzachjonesnoel a year agoNot sure if you really want the user to navigate to CNN.com or it is just a sample, if you are trying on the domain where you have access,  you can allow the requests from Cognito domain with "Access-Control-Allow-Origin".Share"

Answer: "0I just realized it is not a cognito issue. The browser receives a 302 status and a location but it is not redirecting.  So cognito is doing its part, i just need to figure out the code to force the browser to redirect.CommentSharerttanswered 3 years ago0Your call to the Cognito /logout endpoint shouldn't be an XHR request -- the browser needs to be redirected to there. Cognito will then log the user out and redirect them back to the value you provided in redirect_uri.CommentSharejamessanswered 3 years ago0Not sure if you really want the user to navigate to CNN.com or it is just a sample, if you are trying on the domain where you have access,  you can allow the requests from Cognito domain with "Access-Control-Allow-Origin".CommentSharezachjonesnoelanswered a year ago0Hey @rtt how did you solve this? I am having the exact same redirect issue with a 302, and cors error.CommentShareakaksharanswered 10 months ago"


Question: Lambda to RDS Connectivity

"Hi,I'm wanting to establish connectivity to an RDS instance from some Lambda functions. Lambda functions are autodeployed with serverless framework, so ideally my config would be dynamic. I am currently managing infrastructure with CDK, and have the following resources:RDS on Private Isolated subnet in VPC A, managed by CDKEC2 instance on public subnet in VPC A, managed by CDK (For access to the RDS from the wider internet)(Backend) 4 Lambdas without a VPC (Public), behind an API Gateway in default VPC, managed by serverless deployFrontend hosted on S3 behind Cloudfront, managed by serverless deployI'm a bit stumped because I don't want to update my CDK script whenever the lambdas change. Help is much appreciated.FollowComment"

Answer: 0Accepted AnswerThere is no need to update the CDK scripts. All you need to do is attach the functions to some private subnets in the same VPC. Look at this to find out how to reference a CloudFormation Output in your serverless yaml.CommentShareEXPERTUrianswered a year agoManav a year agoAm I ok to put them in the same Private Isolated subnet as the RDS? Otherwise I can create private subnets on the VPC and put them there. How do I then allow access to the RDS?ShareUri EXPERTa year agoI think it would be better to attach the functions to different subnets in the same VPC. In the RDS security group reference the Lambda security group to allow access.Share


Question: Unable to connect to my application securely in HTTPS

"Hello everybody.I currently host my app on a Windows VPS with Amazon. The app works great when I use it on the internet at the domain address that points to my IP address. However, the application is not secure because it is not in HTTPS. So for everything to be safe I have activated an SSL certificate which works well on my Windows server as you can see on the screenshot where we see that I can go to the login box without problem and we can see that the page is secure with the small padlock.On the other hand, when I connect to one of my applications I receive this as a message (see screenshot below.)And when I try to go to the page where I can connect directly to an application, I receive this as a message (see screenshot below).Is this not working because my apps are running with their own server which is the Tomcat server which is installed on my Windows VPS and if that is the problem is there anyone who can tell me how run my applications that use a Tomcat server on a Windows VPS so that when you enter my applications they are in HTTPS.Thanks for your help.FollowComment"

Answer: "0It sounds like your using Lightsail, I would suggest you set up a load balancer in front of your application server and configure it to use a certificate (SSL).   You then don't need to have SSL configured on your server.Here are the two articles that I think will help:https://lightsail.aws.amazon.com/ls/docs/en_us/articles/create-lightsail-load-balancer-and-attach-lightsail-instanceshttps://lightsail.aws.amazon.com/ls/docs/en_us/articles/create-tls-ssl-certificate-and-attach-to-lightsail-load-balancer-httpsOnce you have this in place, your instance doesn't need to be accessible from the outside, which will make it more secure.Hope this helps.CommentShareCarlos del Castilloanswered 18 days ago0Your Java servlet is throwing an error and I would read that carefully (I'm not 100% familiar with what is behind this so I'm deliberately being vague) - but given that it is saying "domain parameter is not specified" you need to configure whatever that is. Perhaps the certificate name, hostname or something else does not match what it expects?CommentShareEXPERTBrettski-AWSanswered 18 days ago"


Question: "With RDS datasources, how do I insert values with colons?"

"We have a mutation resolver that uses RDS datasource, where the mapping template will compose a variableMap with date strings in ISO formats.For example, when running these SQL statements for either insert or update with the date string 1970-01-01T00:00:00Z inside the variableMap, the RDS Data API returns the following error.RDSHttp:{"message":"Cannot find parameter: 00"}It seems that RDS data source is trying to recursively replacing variables with values, even if those are already inside a variableMap.Is there a workaround for this?How do I provide date-time values for RDS resolvers?FollowComment"


Question: Migrating a machine with a public IP from Azure

"Hi Everyone, Would like to migrate a machine that has a public IP Address from Azure.The setup is as followsI have 2 Subnet which are both Private (Migrate 192.168.2.0/24 \ Staging 192.168.1.0/24)Replication Setting template has been setup as follows.Replication ServersSubnet - StagingReplication Server instance type - t3.smallEBS volume type (for replicating disks over 500 GiB) - Faster, General Purpose SSD (gp2)EBS encryption - DefaultAlways use Application Migration Service security group - YesAdditional security groups - NoneData routing and throttlingUse private IP for data replication - NoCreate public IP - YesThrottle network bandwidth (per server) - No throttlingReplication resources tagsNo resource tags existSource Server has all been setup and has imported and the status is Ready for testingI run the job and this is what I receive in the Job log12/11/2021, 15:14:58Job started12/11/2021, 15:14:58Started taking snapshotSource server : DC0112/11/2021, 15:15:39Finished taking snapshotSource server : DC0112/11/2021, 15:15:40Conversion startedSource server : DC0112/11/2021, 15:28:06Conversion endedSource server : DC01Conversion Server instance ID: *****************12/11/2021, 15:28:07Started launching test/ cutover EC2 instanceSource server : DC0112/11/2021, 15:38:13Launching of test/ cutover instance failedSource server : DC01Error: An error occurred (InvalidParameter) when calling the RunInstances operation: The AssociatePublicIpAddress parameter is only supported for VPC launches.I have tried changing this section in the Replication Setting template to say no but it still fails.Data routing and throttlingCreate public IP - NoI have tried to search the forums but don't find anything and I am running out of ideas.FollowComment"

Answer: 0This was an issue with the Subnet.CommentShareIvanEndicottanswered 2 years ago


Question: Lua API Document and Lua Editor

"Hi All,I'm new to lumberyard , and just learn it with tutorial . My question is where to open the lua editor ? And Where to find a lua interface api document ?? I search it both on net and editor ,all the result in web seems not available . .Thanks a lot .Follow"

Answer: "0Accepted AnswerHi @REDACTEDUSERAs for the documentation, this is currently all the LUA documentation that is available but we will have more documentation with the next update coming very soon.SharerePost-User-8353690answered 6 years ago0Try with this URL. Also might try clearing your cache...http://docs.aws.amazon.com/lumberyard/latest/developerguide/lua-scripting-intro.htmlSharerePost-User-8353690answered 6 years ago0Thanks a lot ,@Binky .I found the luaide.I have been to this web site,not available for me .REMOVEDUPLOADSharerePost-User-6388106answered 6 years ago0same result not found ..I try use http://docs.aws.amazon.com/lumberyard/latest/developerguide/lua-scripting-intro.html,but the web translate it to https://aws.amazon.com/lumberyard/latest/developerguide/lua-scripting-intro.html/ .SharerePost-User-6388106answered 6 years ago0Try without the http:// and see if that works. You may also try clearing your cache. You might have that 404 page cached in there...docs.aws.amazon.com/lumberyard/latest/developerguide/lua-scripting-intro.htmlSharerePost-User-8353690answered 6 years ago"


Question: Not able to find a public AMI shared with me

I am not able to find a public AMI shared with me. Following are the AMIs and their region is us-east-1ami-04c8ef1dee652fe24ami-0873e53fa97716fcdI used the AWS console and tried both public and private image filters. Did anyone face such a problem before?FollowComment

Answer: "2Accepted AnswerThe first AMI in your list, ami-04c8ef1dee652fe24, is deprecated. You can still see in if you use describe-images with the CLI:$  aws --region us-east-1 ec2 describe-images --image-ids ami-04c8ef1dee652fe24{    "Images": [        {            "Architecture": "x86_64",            "CreationDate": "2020-11-06T18:25:27.000Z",            "ImageId": "ami-04c8ef1dee652fe24",            "ImageLocation": "188182112697/INSIDER-System (Public)",            "ImageType": "machine",            "Public": true,            "OwnerId": "188182112697",            "PlatformDetails": "Linux/UNIX",            "UsageOperation": "RunInstances",            "State": "available",            "BlockDeviceMappings": [                {                    "DeviceName": "/dev/xvda",                    "Ebs": {                        "DeleteOnTermination": true,                        "SnapshotId": "snap-0fc9bee27e4385046",                        "VolumeSize": 300,                        "VolumeType": "gp2",                        "Encrypted": false                    }                }            ],            "Description": "Build Nov 6, 2020.  An FPGA-based full-stack in-storage computing system.  You would need to import a valid Xilinx Vivado 2017.4 license to use.  Find the INSIDER system at /home/centos/INSIDER-System/",            "EnaSupport": true,            "Hypervisor": "xen",            "Name": "INSIDER-System (Public)",            "RootDeviceName": "/dev/xvda",            "RootDeviceType": "ebs",            "SriovNetSupport": "simple",            "VirtualizationType": "hvm",            "DeprecationTime": "2022-11-06T18:25:27.000Z"        }    ]}Note the "DeprecationTime": "2022-11-06T18:25:27.000Z" field is in the past. As mentioned in the docs:For AMI users, the deprecated AMI is not available to select via the EC2 console. For example, a deprecated AMI does not appear in the AMI catalog in the launch instance wizard. AMI owners continue to see deprecated AMIs in the EC2 console.Pretty confusing experience really - the owner still sees it in the console, but nobody else can. Fortunately, the owner can cancel the deprecation.The other AMI, ami-0873e53fa97716fcd, does not seem to exist at all, at least not in us-east-1.CommentShareEXPERTbwhaleyanswered 5 months ago"


Question: S3 object count using Athena CuR

"Customer is migrating their s3 buckets from one account to another one. They have multiple accounts and each account has around 170 buckets. Many buckets have millions of objects stored. Customer is looking for a way to get the object count for each account in a single csv format, to make sure that the data is migrated correctly to new account buckets. Is there any way to get the object count using the athena query to CuR?FollowComment"

Answer: 0Accepted AnswerI suspect that CloudWatch metrics may be a better mechanism to create your reference file: https://docs.aws.amazon.com/AmazonS3/latest/dev/cloudwatch-monitoring.htmlAs you'll see on that page you can use the Daily Storage Metrics to return the NumberOfObjects per bucket.You could then write some code to iterate over the regions and buckets returning the number of objects and building your reference file.CommentShareColin_Manswered 3 years ago


Question: "dynamodb  putitem is successful, but there is no some data missing"

"I use nodejs and aws-sdk to use dynamicodb.It's weird using putitem. I was successful in the result of Putitem. However, if I check the contents of the table, only a part of the data is included.The table contains exactly 100 items normally, and only some of the data that exceeds 100.Similar results were obtained by using batchWrite instead of putitem.What more should I check?FollowCommentMLGuy a year agoHow do you keep the table to have 100 items? Is there a process that deletes items? Are you using TTL on the items? How do you check for the items? Scan? Management Console?ShareAWS-User-1554221 a year agoThank you for your attention. Finally, the number of data I put in is 500. However, there are only 100 accurate data that can be checked in the aws console.One data size is confirmed to be approximately 0.2k. I've tried it on-demand and I've tried Write Capacity Units(30).A value higher than the measurable write value in aws, and no warning was generated in aws cloudwatch.I didn't ask to delete the data and I didn't set up the TTL. I checked the data in aws console.It was confirmed that the value of httresponse in the result of aws was OK and the error value was null.Just in case, I tried to change the time from 1 to 10 seconds with settimeout every time I put one item, but the result was the same.ShareMLGuy a year agoThe items that you can see in the aws management console are not the only ones in the table. You can also paginate in the console to see more items that are the result of a SCAN command. Please note that in the console you can also see the number of items (under "Items summary") in a table instead of the list of them. You can refresh that number using the "Get live item count" button.Share"

Answer: "0Please make sure you're doing a strongly consistent read, not eventually consistent read. If you're doing EC reads then it's expected and normal to not see a very recent write.CommentSharejzhunteranswered a year agoAWS-User-1554221 a year agoThank you for your answer. I tried transactionwrite and I didn't check the data in my node, but in aws console. Of course, data was checked even after time, but data was not included.Share"


Question: How do you change S3 Content-Type metadata through the API?

"This Document makes it clear that you can change the Metadata of an object.  Through the console it works fine.  I can't figure out how you're supposed to do it through the API.I have a problem that has been asked before: CloudFront sourced by an S3 bucket, and if the Content-Type is wrong it does the wrong thing.  When I upload an xyz.js file it labels the content as 'text/plain'.  I'm doing this through a variety of clients including plain old s3cmd.  I can specify the type on the s3cmd command line but I don't particularly want to - I'm trying to make this easy for people who are not me.What I'm trying to do is an S3 - Lambda notification, in two steps:When I receive the S3CreateEvent, execute a HeadObjectCommand on that bucket/key to get the current metadata.In that response, look at GetObjectCommandOutput.Metadata and see if it has a key "content-type".  If so, does it match?  If it does not match, do a CopyObjectCommand but I set both ContentType and Metadata: { "content-type": "text/javascript" }The trouble is, I never find an existing content-type in Metadata using the keys "Content-Type", "content-type", nor "contentType".  I GUESS I could just do the CopyObjectCommand every time, but it seems better to check first and avoid any kind of recursion.  It's not clear to me if CopyObjectCommand will trigger another notification but a test left me believing it does.It's still weird to me that if you upload an .js file the default content-type seems to be text/plain.  In fact, in the s3 console it shows up in two places:  Type: js, and in the metadata it shows "System Generated, Content-Type, text/plain".If I use `aws s3 cp junk2.js s3://mybucketname --content-type="text/javascript" it does the correct thing.This problem is much discussed on stackoverflow but it's mostly just workarounds.  There isn't a clear answer.FollowComment"

Answer: 0Accepted AnswerHave you tried looking for 'ContentType'? See: Interface HeadObjectCommandOutputCommentShareEXPERTkentradanswered 6 months agoEXPERTAWS-User-Nitinreviewed 6 months agowz2b 6 months agoI didn't realize if I change ContentType that it would generate a Content-Type headerShare


Question: Quicksight not able to ingest dataset bigger than 1GB at a time

"Hello,I am trying to analysis a few datasets (which are all bigger than 1GB), and they are mostly either CSV or Excel datasets. The goal is to be able to build dashboards with different datasets.I found that upon trying to ingest them into Quicksight, I got this error:quicksight File size cannot be greater than 1 GBI would appreciate some help from the experts on methods to resolve this. I have read that some methods are to use Athena or S3 as a solution,before being able to ingest the data into Quicksight to build dashboards - but I am not sure which is the best way.Could someone please help with a tutorial to get this resolved ?Thank you,FollowComment"

Answer: 0Check you SPICE size if it is full.go to account setting and select Manage Quicksight.It shows you the current and available size of SPICE.Just extend it.CommentShareNaveed Hashmianswered a year ago


Question: Free tier limits decrease

Hello. I have created Siemens LOGO! web page in AWS according Siemens instructions. There is only one web page created with tree analogue temperature values. My expectation was to test the temperatures on my smartphone when I am not at home. I planed to try free tier first for testing my software. The web page really can be opened on my phone. But now I get email warnings about free tier data transfer usage limit even if my LOGO! is diconnected from Internet and no data could be transferred. Similar problem is also with AmazonEC2 time 750 Hours free limit for April. The warning says 648 Hours spent already even if on April 10th even if 10 days means only 240 Hours. These free tier values are decreasing even if my LOGO! is disconnected from Internet. Please could the limits remain the same if my LOGO! cannot be accesssed and also my web page is not opened probably on any computer?I am not sure why my Free tier limits decrease if LOGO! PLC is disconnected from Internet  and no data transfer (or communication) is possible.FollowComment

Answer: 1Accepted AnswerIt's a bit hard to give you an good answer on this. But to me it sounds like you have three EC2 instances running. The instances would keep running even if you disconnect your LOGO PLC. You should stop any running EC2 instances to ensure they don't consume from your monthly free tier.CommentShareJimmyDqvanswered 2 months agoEXPERTalatechreviewed 2 months ago


Question: Is it possible to see CPU Utilization monitoring over a longer period than just two weeks?

"Hi ThereIn RDS > Databases > MonitoringI need to see CPU utilization over a longer period of time than just the past two weeks. I'd like to see it over the past two years. Does anyone have any guidance to offer? We're seeing a CPU Utilization spike every day from 12:04pm-12:31pm Pacific time and we're trying to see when it started, so we can see from our logs the changes that were pushed right before.Can anyone help?FollowComment"

Answer: 0You can refer Amazon Cloudwatch metrics for extended period - please refer FAQ: What is the retention period of all metrics? and announcement CloudWatch extends Metrics retention and new User InterfaceYou can also refer Metrics Retention and Cloudwatch API reference GetMetricStatistics for more details.CommentShareAshish_Panswered 10 months ago


Question: EC2 Instance Stuck Shutting Down

"Instance  i-0d75d38ac025b99ad stuck in "shutting-down" state and won't terrminate.$ aws --region us-east-1 --profile eng ec2 terminate-instances --instance-id i-0d75d38ac025b99ad{"TerminatingInstances": [{"InstanceId": "i-0d75d38ac025b99ad","CurrentState": {"Code": 32,"Name": "shutting-down"},"PreviousState": {"Code": 32,"Name": "shutting-down"}}]}FollowComment"

Answer: "0Hi,I can see that the instance has now been stopped.CommentShareAWS-User-8424448answered 3 years ago"


Question: ASG instance refresh spends too much time evaluating instance health

"I have an Auto Scaling Group using Lifecycle Hooks; the ASG is hooked up to an Elastic Load Balancer as well. When I perform an instance refresh on the ASG, the instances complete their launching lifecycle action relatively quickly and enters the InService state. However, the instance refresh then pauses for about 90 seconds after each instance enters the InService state, and the instance refresh status reason reads as following:Waiting for remaining instances to be available. For example: i-XXXXXXXXXXXX has insufficient data to evaluate its health with Elastic Load Balancing.Both the health check grace period and instance warmup are set to zero, and the associated target group is configured to consider instances healthy after 2 successful health checks with a 10-second interval. Given that, I'd expect to spend at most 20 seconds waiting for ELB health data, not the nearly 90 seconds I observe in practice. How can I configure my ASG to proceed with the next instance replacement immediately after the previously-replaced instance enters the InService state?FollowCommentjgard a month ago@nwalters512 , did you ever get to the bottom of this?  Is there maybe a minimum unconfigurable timespan for instance warmup?Share"


Question: how to get STS regional endpoints in a real scenario?

"how to get regional endpoints in a real scenario?I tried:return g_boto3_session.client(service,region_name=region,aws_access_key_id=access_key,aws_secret_access_key=secret_key,aws_session_token=security_token,config=config,endpoint_url=https://sts.us-west-2.amazonaws.com)FollowComment"

Answer: 0This question has been answered in detail during the AWS Supports You event. Answer is provided here .CommentShareSUPPORT ENGINEERMonica_Lluisanswered 8 months ago


Question: BGP Down suddenly

"Hi,Regards,Edited by: Informatique on Oct 16, 2019 1:22 AMFollowComment"

Answer: 0HiAfter looking at your account and verifying that the link is down this is the results of your main connection that is hosting your own connection:: dxcon-fgu7vvodThe main connection is down with the following light signals.Light Levels:Transmit (TX) Signal dBm: -1.16Received (RX) Signal dBm: - InfGood signal between (-14.4 and 2.50) dBmThis shows AWS is not receiving light signals at all from the main connection.I would suggest you reach out to your provider on checking their main connection for possible error or SFP issues and/or reach out to us for additional support regarding the above readings.Regards CurtCommentShareCurt08answered 4 years ago


Question: ShadowManager encountering issues and shutting down IPC service

"I am facing an issue where it seems that the ShadowManager is encountering some issues, and shutting down the IPC service I believe.I haven't had this issue before, and it only came when I added the ShadowManager.After a little while, when it shuts it down, other components that need IPC are no longer able to subscribe to topics.I've got the below from the greengrass.log2023-05-04T18:42:48.323Z [INFO] (pool-2-thread-48) com.aws.greengrass.tes.TokenExchangeService: TokenExchangeService is shutting down!. {serviceName=aws.greengrass.TokenExchangeService, currentState=STOPPING}2023-05-04T18:42:49.327Z [INFO] (pool-2-thread-48) com.aws.greengrass.tes.TokenExchangeService: Stopped server at port 43297. {serviceName=aws.greengrass.TokenExchangeService, currentState=STOPPING}2023-05-04T18:42:49.328Z [INFO] (aws.greengrass.TokenExchangeService-lifecycle) com.aws.greengrass.tes.TokenExchangeService: service-set-state. {serviceName=aws.greengrass.TokenExchangeService, currentState=STOPPING, newState=FINISHED}2023-05-04T18:43:03.109Z [ERROR] (aws.greengrass.ShadowManager-lifecycle) com.aws.greengrass.shadowmanager.ShadowManager: service-errored. {reason=Timeout in shutdown, serviceName=aws.greengrass.ShadowManager, currentState=STOPPING}2023-05-04T18:43:03.110Z [INFO] (aws.greengrass.ShadowManager-lifecycle) com.aws.greengrass.shadowmanager.ShadowManager: service-set-state. {serviceName=aws.greengrass.ShadowManager, currentState=STOPPING, newState=ERRORED}2023-05-04T18:43:03.115Z [WARN] (pool-2-thread-12) com.aws.greengrass.deployment.IotJobsHelper: Interrupted while subscribing to Iot Jobs descriptions topic. {ThingName=DOWNSTAIRS-TESTBENCH-2}2023-05-04T18:43:03.116Z [WARN] (FleetStatusService-lifecycle) com.aws.greengrass.status.FleetStatusService: service-state-transition-interrupted. Service lifecycle thread interrupted. Thread will exit now. {serviceName=FleetStatusService, currentState=FINISHED}2023-05-04T18:43:03.116Z [WARN] (aws.greengrass.SecretManager-lifecycle) com.aws.greengrass.secretmanager.SecretManagerService: service-state-transition-interrupted. Service lifecycle thread interrupted. Thread will exit now. {serviceName=aws.greengrass.SecretManager, currentState=FINISHED}2023-05-04T18:43:03.114Z [WARN] (pool-2-thread-13) com.aws.greengrass.deployment.ShadowDeploymentListener: Interrupted while subscribing to device shadow topics. {}2023-05-04T18:43:03.116Z [ERROR] (pool-2-thread-38) com.aws.greengrass.shadowmanager.sync.CloudDataClient: cloud-data-client-subscription-error. Failed to update subscriptions. {}java.lang.InterruptedException    at java.util.concurrent.CompletableFuture.reportGet(Unknown Source)    at java.util.concurrent.CompletableFuture.get(Unknown Source)    at com.aws.greengrass.mqttclient.MqttClient.subscribe(MqttClient.java:410)    at com.aws.greengrass.shadowmanager.sync.CloudDataClient.subscribeToShadows(CloudDataClient.java:260)    at com.aws.greengrass.shadowmanager.sync.CloudDataClient.lambda$updateSubscriptions$1(CloudDataClient.java:173)    at com.aws.greengrass.util.RetryUtils.runWithRetry(RetryUtils.java:50)    at com.aws.greengrass.shadowmanager.sync.CloudDataClient.updateSubscriptions(CloudDataClient.java:171)    at com.aws.greengrass.shadowmanager.sync.CloudDataClient.lambda$updateSubscriptions$0(CloudDataClient.java:139)    at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)    at java.util.concurrent.FutureTask.run(Unknown Source)    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)    at java.lang.Thread.run(Unknown Source)2023-05-04T18:43:03.117Z [WARN] (pool-2-thread-47) com.aws.greengrass.shadowmanager.sync.strategy.BaseSyncStrategy: sync. Interrupted while waiting for sync requests. {}2023-05-04T18:43:03.119Z [INFO] (pool-2-thread-47) com.aws.greengrass.shadowmanager.sync.strategy.BaseSyncStrategy: sync. Finished processing sync requests. {}2023-05-04T18:43:03.117Z [WARN] (pool-2-thread-42) com.aws.greengrass.mqttclient.MqttClient: Shutting down spooler task. {}2023-05-04T18:43:03.122Z [INFO] (pool-2-thread-25) com.aws.greengrass.shadowmanager.sync.strategy.BaseSyncStrategy: sync. Stop syncing. {}2023-05-04T18:43:03.123Z [INFO] (pool-2-thread-25) com.aws.greengrass.shadowmanager.sync.strategy.BaseSyncStrategy: sync. Cancel 1 sync thread(s). {}2023-05-04T18:43:03.131Z [INFO] (Serialized listener processor) com.aws.greengrass.lifecyclemanager.KernelLifecycle: executor-service-shutdown-initiated. {}2023-05-04T18:43:03.130Z [WARN] (pool-2-thread-13) com.aws.greengrass.mqttclient.MqttClient: Failed to run MQTT spooler. {}java.util.concurrent.RejectedExecutionException: Task java.util.concurrent.FutureTask@3df83b86 rejected from java.util.concurrent.ThreadPoolExecutor@66954c7d[Shutting down, pool size = 2, active threads = 2, queued tasks = 0, completed tasks = 163]    at java.util.concurrent.ThreadPoolExecutor$AbortPolicy.rejectedExecution(Unknown Source)    at java.util.concurrent.ThreadPoolExecutor.reject(Unknown Source)    at java.util.concurrent.ThreadPoolExecutor.execute(Unknown Source)    at java.util.concurrent.AbstractExecutorService.submit(Unknown Source)    at com.aws.greengrass.mqttclient.MqttClient.triggerSpooler(MqttClient.java:427)    at com.aws.greengrass.mqttclient.MqttClient.publish(MqttClient.java:524)    at com.aws.greengrass.mqttclient.WrapperMqttClientConnection.publish(WrapperMqttClientConnection.java:96)    at software.amazon.awssdk.iot.iotshadow.IotShadowClient.PublishGetNamedShadow(IotShadowClient.java:425)    at com.aws.greengrass.deployment.ShadowDeploymentListener.publishToGetDeviceShadowTopic(ShadowDeploymentListener.java:310)    at com.aws.greengrass.deployment.ShadowDeploymentListener.lambda$setupShadowCommunications$2(ShadowDeploymentListener.java:209)    at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)    at java.util.concurrent.FutureTask.run(Unknown Source)    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)    at java.lang.Thread.run(Unknown Source)2023-05-04T18:43:03.133Z [INFO] (Thread-1) com.aws.greengrass.lifecyclemanager.KernelLifecycle: Waiting for executors to shutdown. {}2023-05-04T18:43:03.133Z [INFO] (Thread-1) com.aws.greengrass.lifecyclemanager.KernelLifecycle: executor-service-shutdown-complete. {executor-terminated=false, scheduled-executor-terminated=true}2023-05-04T18:43:03.136Z [INFO] (Thread-1) com.aws.greengrass.lifecyclemanager.KernelLifecycle: context-shutdown-initiated. {}2023-05-04T18:43:03.136Z [ERROR] (Thread-4) com.aws.greengrass.mqttclient.MqttClient: Error subscribing. {topic=$aws/things/DOWNSTAIRS-TESTBENCH-2/jobs/$next/namespace-aws-gg-deployment/get/accepted}java.util.concurrent.CompletionException: java.util.concurrent.RejectedExecutionException: Task java.util.concurrent.FutureTask@5bfdc9e rejected from java.util.concurrent.ThreadPoolExecutor@66954c7d[Shutting down, pool size = 10, active threads = 3, queued tasks = 0, completed tasks = 162]    at java.util.concurrent.CompletableFuture.encodeThrowable(Unknown Source)    at java.util.concurrent.CompletableFuture.completeThrowable(Unknown Source)    at java.util.concurrent.CompletableFuture.uniApply(Unknown Source)    at java.util.concurrent.CompletableFuture$UniApply.tryFire(Unknown Source)    at java.util.concurrent.CompletableFuture.postComplete(Unknown Source)    at java.util.concurrent.CompletableFuture.complete(Unknown Source)    at software.amazon.awssdk.crt.AsyncCallback$1.onSuccess(AsyncCallback.java:27)    at software.amazon.awssdk.crt.mqtt.MqttClientConnection.onConnectionComplete(MqttClientConnection.java:138)Caused by: java.util.concurrent.RejectedExecutionException: Task java.util.concurrent.FutureTask@5bfdc9e rejected from java.util.concurrent.ThreadPoolExecutor@66954c7d[Shutting down, pool size = 10, active threads = 3, queued tasks = 0, completed tasks = 162]    at java.util.concurrent.ThreadPoolExecutor$AbortPolicy.rejectedExecution(Unknown Source)    at java.util.concurrent.ThreadPoolExecutor.reject(Unknown Source)    at java.util.concurrent.ThreadPoolExecutor.execute(Unknown Source)    at java.util.concurrent.AbstractExecutorService.submit(Unknown Source)    at com.aws.greengrass.shadowmanager.sync.CloudDataClient.updateSubscriptions(CloudDataClient.java:139)    at com.aws.greengrass.shadowmanager.ShadowManager.startSyncingShadows(ShadowManager.java:553)    at com.aws.greengrass.shadowmanager.ShadowManager$1.onConnectionResumed(ShadowManager.java:114)    at com.aws.greengrass.mqttclient.CallbackEventManager.runOnInitialConnect(CallbackEventManager.java:49)    at com.aws.greengrass.mqttclient.AwsIotMqttClient.lambda$connect$7(AwsIotMqttClient.java:246)    ... 6 more2023-05-04T18:43:03.138Z [ERROR] (Thread-4) com.aws.greengrass.mqttclient.MqttClient: Error subscribing. {topic=$aws/things/DOWNSTAIRS-TESTBENCH-2/tunnels/notify}java.util.concurrent.CompletionException: java.util.concurrent.RejectedExecutionException: Task java.util.concurrent.FutureTask@5bfdc9e rejected from java.util.concurrent.ThreadPoolExecutor@66954c7d[Shutting down, pool size = 10, active threads = 3, queued tasks = 0, completed tasks = 162]    at java.util.concurrent.CompletableFuture.encodeThrowable(Unknown Source)    at java.util.concurrent.CompletableFuture.completeThrowable(Unknown Source)    at java.util.concurrent.CompletableFuture.uniApply(Unknown Source)    at java.util.concurrent.CompletableFuture$UniApply.tryFire(Unknown Source)    at java.util.concurrent.CompletableFuture.postComplete(Unknown Source)    at java.util.concurrent.CompletableFuture.complete(Unknown Source)    at software.amazon.awssdk.crt.AsyncCallback$1.onSuccess(AsyncCallback.java:27)    at software.amazon.awssdk.crt.mqtt.MqttClientConnection.onConnectionComplete(MqttClientConnection.java:138)Caused by: java.util.concurrent.RejectedExecutionException: Task java.util.concurrent.FutureTask@5bfdc9e rejected from java.util.concurrent.ThreadPoolExecutor@66954c7d[Shutting down, pool size = 10, active threads = 3, queued tasks = 0, completed tasks = 162]    at java.util.concurrent.ThreadPoolExecutor$AbortPolicy.rejectedExecution(Unknown Source)    at java.util.concurrent.ThreadPoolExecutor.reject(Unknown Source)    at java.util.concurrent.ThreadPoolExecutor.execute(Unknown Source)    at java.util.concurrent.AbstractExecutorService.submit(Unknown Source)    at com.aws.greengrass.shadowmanager.sync.CloudDataClient.updateSubscriptions(CloudDataClient.java:139)    at com.aws.greengrass.shadowmanager.ShadowManager.startSyncingShadows(ShadowManager.java:553)    at com.aws.greengrass.shadowmanager.ShadowManager$1.onConnectionResumed(ShadowManager.java:114)    at com.aws.greengrass.mqttclient.CallbackEventManager.runOnInitialConnect(CallbackEventManager.java:49)    at com.aws.greengrass.mqttclient.AwsIotMqttClient.lambda$connect$7(AwsIotMqttClient.java:246)FollowCommentMichaelDombrowski-AWS EXPERTa month agoThis log is indicative of Greengrass as a whole shutting down or restarting.Look for "system-shutdown" in the logs.ShareSash a month agoYeah I can see it littered through my logs - but I am not sure if it has been initiated by me restarting the greengrass service, or because of something else. Here's a small snippet:2023-05-02T17:57:49.440Z [WARN] (Thread-1) com.aws.greengrass.lifecyclemanager.Kernel: Shutting down Nucleus due to external signal. {}2023-05-02T17:57:49.455Z [INFO] (Copier) com.aws.greengrass.lifecyclemanager.GenericExternalService: Run script exited. {exitCode=143, serviceName=com.savic.VehicleDataUploader, currentState=RUNNING}2023-05-02T17:57:49.456Z [INFO] (com.savic.Evaluator-lifecycle) com.aws.greengrass.lifecyclemanager.GenericExternalService: service-set-state. {serviceName=com.savic.Evaluator, currentState=RUNNING, newState=ERRORED}2023-05-02T17:57:49.453Z [INFO] (Thread-1) com.aws.greengrass.lifecyclemanager.KernelLifecycle: system-shutdown. {main=services.main:FINISHED}2023-05-02T17:57:49.461Z [INFO] (Thread-8) software.amazon.awssdk.eventstreamrpc.RpcServer: Server connection closed code [socket is closed.]: Id 37, Class ServerConnection, Refs 1 - <null>. {}2023-05-02T17:57:49.462Z [INFO] (com.savic.ProximityStart-lifecycle) com.aws.greengrass.lifecyclemanager.GenericExternalService: service-set-state. {serviceName=com.savic.ProximityStart, currentState=ERRORED, newState=STOPPING}2023-05-02T17:57:49.463Z [INFO] (com.savic.Evaluator-lifecycle) com.aws.greengrass.lifecyclemanager.GenericExternalService: service-set-state. {serviceName=com.savic.EvalShareMichaelDombrowski-AWS EXPERT25 days agoShutting down Nucleus due to external signal -- you are telling Greengrass to shutdown, so then it does shutdown.ShareSash 23 days agoLook... I've been working on this last 1.5 years, with a comprehensive framework built around GG - so I am well aware when I shut down, start, and restart. This issue where suddenly experiencing is after the introduction of ShadowManager. What happens is after some undetermined time, the service simply no longer is able to subscribe to IPC, the device loses connectivity with AWS, and it no longer can accept GG component updates, or can I no longer SSH into the device via Secure Tunnell.The restarts initiatied from the outside are very likely either:Me restarting it via greengrass-cliMe restarting greengrass.service via systemctl; orMe rebooting the device abruptlyShare"


Question: POST Domain transfer from Epik to Route 53

"I have successfully transferred my domain visaalliance.com from Epik to Route 53 however after 6 days I am still getting the OLD NS.Domain:visaalliance.comRegistrar:Amazon Registrar, Inc.Registered On:2012-12-17Expires On:2023-12-17Updated On:2022-02-26Status:clientTransferProhibitedName Servers:ns3.epik.comns4.epik.comI have already created my hosted zone and my supposed NS are:ns-131.awsdns-16.com.ns-1008.awsdns-62.net.ns-1330.awsdns-38.org.ns-1916.awsdns-47.co.uk.I am barely new with ROUTE 53 so any assistance would be really appreciated.Thank you,EDIT: I managed to solved it. Thanks!FollowComment"

Answer: "1You managed to resolve the issue, but for others finding this question, the solution is to update the name server configuration for the domain to those for the hosted zone: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html ("Adding or changing name servers or glue records").CommentShareJustin Ganswered a year agobasantakharel a year agoI had to delete the DNSSEC from there I was able to update the NS under the Registered Domain information.Share0When you transferred the domain name to Route53, did you choose the option to "Continue to use the name servers provided by the current registrar or DNS service" option?  (See https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-transfer-to-route-53.html under Name Server Options).   If yes, then the domain was transferred with the existing Name Servers in tact.If that is the case,  you will need to update the name servers for the domain manually in Route53 to the ones that are provided in the hosted zone.  See:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-name-servers-glue-records.html#domain-name-servers-glue-records-adding-changingCommentShareEXPERTMatt-Banswered a year ago"


Question: lambda take few seconds to return response

"Hi team,I created a custom lambda authorizer and attached it to my HTTP API GW authorizer.1 - I noticed each time that the lambda authorizer is slow, it takes around 3 to 4 seconds to get the response (maybe it's due to my lambda reading secret keys from secret manager ?)my lambda read apiKeys from secret manager and compares it with a custom header value on the HTTP request2 - also, the lambda took more than 5 seconds to wake up.Is there any way to solve this latency related to the lambda authorizer for these points?Thank youFollowComment"

Answer: 0For the first part you might consider putting setup code outside the Lambda function handler so that it is only executed once (on cold starts).For the second part: You don't say what runtime language you're using in Lambda; there are a lot of tips on the web and in our documentation for reducing cold start times for Lambda functions. I'd link to them but without knowing the language I'd suggest instead that you search for "lambda reduce cold start" and add your runtime there.You might also consider using Lambda Provisioned Concurrency but bear in mind there is a cost for that.CommentShareEXPERTBrettski-AWSanswered a year ago


Question: Instances Missing

"Good Morning,Last week, our instances missing from https://ap-southeast-1.console.aws.amazon.com/  ?How to get back the Instances (Windows Platform) ?Thank you.FollowComment"

Answer: "0If your instances are missing from the AWS Management Console in the ap-southeast-1 region, there are a few steps you can take to try to resolve the issue:Verify the region: Make sure that you are in the correct region (ap-southeast-1) in the AWS Management Console.Check the instances' state: Go to the EC2 Dashboard and check the state of the instances. If they are in a stopped state, you can start them from the AWS Management Console.Check the VPC: Make sure that the instances are in a VPC and that the VPC is correctly configured and has the correct subnets, security groups, and network ACLs.Check the network interfaces: Make sure that the network interfaces are correctly associated with the instances and that they have the correct private and public IP addresses.Check the instances' tags: Make sure that the instances have the correct tags and that the tags are correctly associated with the instances.Check the instances' visibility: Make sure that the instances are not hidden from the console due to the "AWS Management Console" tag value.Contact AWS Support: If you are still unable to find your instances, you can contact AWS Support for further assistance.Note: These steps are applicable to instances running on a Windows platform.CommentShareGabriel Olaleyeanswered 4 months ago"


Question: outbound traffic / iprules in a lightscale instance

"Hi,I neet to control outbound traffic from my ufw in a lightscale instance. i see inbound can be defined in the aws panel under the instance networking options, however i dont see it for inbound.i tried doing it via ubuntu firewall as well, but even thats not possible.FollowComment"

Answer: "1Thank you for the input: >> assuming you meant amazon Lightsail <<In the networking tab of Lightsail you can only configure the inbound traffic firewall rules to the public IP of your instance."Firewall rules affect only traffic that flows in through the public IP address of an instance. It does not affect traffic that flows in through the private IP address of an instance, which can originate from Lightsail resources in your account, in the same AWS Region, or resources in a peered virtual private cloud (VPC), in the same AWS Region. "I'm assuming you meant outbound here in your question: "...however i dont see it for inbound..."There isn't much control on the Lightsail VPC itself when you're about to create an instance except picking the region and AZ (No SG, Network ACL...)However I did spin up an Ubuntu instance on my Lightsail test environment and was able to control outbound traffic straight from ufw.my rules:sudo ufw default deny outgoingsudo ufw default deny incomingsudo ufw allow sshsudo ufw allow out 53sudo ufw allow out httpsudo ufw allow out httpsTest:CommentShareJules_Nanswered a year ago0Are you talking about "Inbound" & "Outbound" Rules? If yes, then you find it under "Security" tab of your instances; the actual config lies within the "Security Groups " config under your EC2 Dashboard (Not Under "Networking").That's where you control traffic straight in/out of your instance.CommentShareJules_Nanswered a year agoAWS-User-8984744 a year agoyes, but you are still talking about EC2, I am looking for the same in lightscaleShare0Interesting can I do the same for a particular service e.g. WhatsApp.CommentShareAWS-User-8984744answered a year ago"


Question: Can someone explain the point of MessageGroupId?

"I need to use FIFO.What is the point of MessageGroupId?https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/using-messagegroupid-property.html"The message group ID is the tag that specifies that a message belongs to a specific message group. Messages that belong to the same message group are always processed one by one, in a strict order relative to the message group (however, messages that belong to different message groups might be processed out of order). "SAY WHAT?!This is why I create different queues and stuff.  So there are different queues with different names and different queues.Is the point of MessageGroupId to create queues within queues?  Why would you ever want to do that without confusing other team members?Is MessageGroupId required if I want to use FIFO?This article goes on (kill me):"Any scenario with multiple producers and consumers increases the risk of inadvertently delivering a duplicate message if a worker doesn't process the message within the visibility timeout and the message becomes available to another worker."Who engineered this?  Please come explain this.FollowComment"

Answer: "2If you need all messages in a FIFO queue to be delivered in strict order, just use the same MessageGroupId for all messages. You can name it "default-group". Having that will work just fine, but remember that a FIFO queue like that will not give out the next available message until the previously received message is deleted -> this is the way such queue guarantees processing in order. So you maximum throughput of a pure FIFO queue like that will be limited.There are however common use cases where you don't need strict ordering of all messages. Imagine a system that keeps track of user data and provides notification about changes to user data. You may want to get notification of changes about particular user in order, but you may want to process notification about different users in parallel.If you use a single FIFO queue, all notifications will get processed in sequence, no parallelism is possible.If you use a queue per user, then with a lot of users you need a lot of queues and you need to call ReceiveMessage on each queue to find if there's anything to process.You can use a single FIFO queue and provide user id as MessageGroupId. You can then poll for messages from that single queue and SQS FIFO queue will give you message that belong to same MessageGroupId in order, but messages with different MessageGroupIds in parallel.This re:Invent talk explores more messaging patterns across AWS services: https://www.youtube.com/watch?v=4-JmX6MIDDICommentShareKubaanswered 3 years ago0I didn't know that FIFO queues couldn't subscribe to SNS topics.  Never mind on this.  It doesn't appear FIFO is ready for prime time.  I'll continue using RabbitMQ.CommentShareA. Petersonanswered 3 years ago"


Question: What routing method is used by the target group? (Not target group transfer from load balancer)

"I know that the target group routing method in the load balancer uses the round robin method.https://docs.aws.amazon.com/ko_kr/elasticloadbalancing/latest/application/load-balancer-target-groups.html#modify-routing-algorithmWhile using auto-scaling, I saw that multiple instances were attached to one target group, and I was curious about its routing method.How do you route when multiple instances are attached to one target group?FollowComment"

Answer: "0Accepted AnswerHi, its documented here.Target group attributesload_balancing.algorithm.typeThe load balancing algorithm determines how the load balancer selects targets when routing requests. ( this applies to targets behind ASG as well )The value is round_robin or least_outstanding_requests.The default is round_robin.https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.htmlCommentShareMuhammadanswered 5 months agoEXPERTTushar_Jreviewed 4 months agojoker 5 months agoThe way you said is an algorithm for the load balancer to select a target group. What I want to know is how the target group selects instances.ShareMuhammad 5 months agoNop. Its attribute of Target group not attribute of load balancer. And it says how target is selected. It dont say how target group is selected.It is the way load balancer send traffic to target within target group.This document is a good readhttps://jayendrapatil.com/aws-elb-application-load-balancer/Share0Like you mentioned, if multiple instances are attached to the same target group and the instances have a status of 'healthy' from the load balancer, the traffic will be evenly distributed in a round robin format to those instances. If you wanted the load balancer to route traffic in a different pattern to different target groups, you can configure that as well by using the "Weighted routing" option. Finally you can enable sticky sessions on you healthy instances within the target group for another routing option.CommentShareCloud_Ganswered 5 months agojoker 5 months agoDoesn't the documentation say how to send multiple instances to one target group?Share"


Question: Authorizer function not logging to CloudWatch

"Greetings.Full Disclosure - I am still very new to AWS.For my first AWS project, I am creating a websocket connection between my website and my DynamoDB table. Inasmuch, I have created the tables, a Websocket API, and the supporting Lambda functions. Everything is working great.I then added a JS Lamba Authorizer function (Node 8.10), and something peculiar is occurring: Within the function, I am using simple console.log statements to help me debug an Unauthorized condition. When I Test the function, the logs appear in CloudWatch. However, when I attempt to make a connection from my website, no logs appear in CloudWatch.All my other Lambda functions - $connect, $disconnect, and the routing functions -  all work normally and output their console.log text to CloudWatch. Only the Authorizer function fails to send logs, and yet when I click on the "Test" button, the logs are sent.I was thinking that there might be some log settings on the function itself, but I'm not able to locate anything other than this entry in the Developer:Allow: logs:CreateLogGroupAllow: logs:CreateLogStreamAllow: logs:DescribeLogGroupsAllow: logs:DescribeLogStreamsAllow: logs:PutLogEventsAllow: logs:GetLogEventsAllow: logs:FilterLogEventsOther than the global log setting in the Websocket API, I can't figure out why all my APIs except the Authorizer will log to CloudWatch.Has anyone run into something like this before, and if so, what did you do to fix it? If not, can anyone give me a hint as to where I can look to debug this issue?Thank you.FollowComment"

Answer: "0To answer my own question, the problem was indeed due to the "Unauthorized" problem that I mentioned but thought it has nothing to do with it.When I setup my authorizer, I set a Lambda Event payload for a custom header, and I had neglected to set that header in my browser session. According to the documentation at https://docs.aws.amazon.com/apigateway/latest/developerguide/configure-api-gateway-lambda-authorization-with-console.html, section 9b, the API Gateway will throw a 401 Unauthorized error without even executing the Lambda function. So that was the source of the problem.CommentShareTheVirtuoidanswered 4 years ago"


Question: Delivering records to Security Lake custom source prefix is not possible with Kinesis Firehose?

"I'm trying to set up custom sources for Security Lake and have a Kinesis Firehose delivery stream configured to deliver parquet files into the Security Lake bucket under the ext/ prefix.The problem I'm encountering is that the AWS::KinesisFirehose::DeliveryStream SchemaConfiguration (under CloudFormation AWS::KinesisFirehose::DeliveryStream Properties->ExtendedS3DestinationConfiguration->DataFormatConversionConfiguration->SchemaConfiguration) requires a table with schema matching the records in order to deliver the data, but Security Lake requires there to be records already there for Glue to crawl and create the table and schema which Firehose needs. It looks like it's not possible to directly stream data using Firehose when setting up Security Lake custom sources and that we need to move the records under the ext/ prefix using Glue or EMR.Is my conclusion correct that this will not work? The fact that Security Lake uses a Glue crawler to create the table makes it less flexible when creating a custom source.FollowCommentabk7777-rtek 19 days agoTo summarize the catch 22:Firehose requires a Glue Table & schema to be set up for delivering parquet recordsSecurity Lake requires existing parquet records to crawl in order to create a Glue Table & schemaShare"

Answer: "1there maybe some alternative approachAWS Kinesis Data Firehose to deliver data to S3 without converting it to Parquet, and then use Glue or Athena to convert and query the data later.One possible workaround could be to manually create a Glue table that matches the schema of the data you're streaming in. You could then point your Firehose delivery stream to this existing Glue table.CommentShareEXPERTsdtslmnanswered 17 days ago"


Question: Synthetics Canary: "Error: net::ERR_ABORTED at...."

"Hello, sometimes my canary script failed and has this error "Error: net::ERR_ABORTED at HTTP........" in most cases when I re-run the script it works again with no issues. What is the possible cause of this error?FollowComment"


Question: Find the Lambda endpoints using Python Boto3 SDK

Find the Lambda endpoints using Python Boto3 SDKFollowComment

Answer: "0You can find this via public parameters. A command line equivalent would look like :aws ssm get-parameter  --name /aws/service/global-infrastructure/regions/us-east-2/services/lambda/endpoint  --query 'Parameter.Value'To do this in Python, take a look at this exampleCommentShareEXPERTkentradanswered a year ago"


Question: Can't receive emails in WorkMail

"Hi there,I would like assistance with emails not being received in WorkMail. Everything seems good from a configuration perspective. I use an externally registered domain. I can also be able to send emails. Please advice on what's needed to get this looked into.Thank you kindly.FollowComment"

Answer: "1Hi,I'm sorry to hear you're experiencing problems with receiving mail. There are some good trouble shooting steps in this answer: https://repost.aws/questions/QULS51gqIQR9mzm7hGydYC4A/problem-with-sending-email-with-workmail#ANSZE6Wcy0QFm_fiyKJb_GvwKind regards,RobinCommentShareMODERATORrobinkawsanswered 8 months agorePost-User-2808493 8 months agoThanks for your response. Any way y'all can look into this for me?Share"


Question: RDS mysql 5.6 to 5.7 upgrade facing issue

"when we are trying RDS MySQL 5.6 to 5.7 upgrade facing issue:"MySQL 5.7 preupgrade check to catch orphan table issue, datadir or frm file was  removed or corrupted"Please help me what to do for this issue ?and how to delete this frm file (we do not have access for directory)FollowComment"

Answer: "0Accepted AnswerIt looks like some or one of the regular or temp tables in the databases are orphaned. Meaning, they exist in the data dictionary but do not have respective files on the storage. This is what I am assuming at this point.Best bet would be to reach out AWS Support so that they can fix it for you.CommentShareD-Raoanswered a year ago"


Question: SSL error for MySQL RDS connection on Kubernetes


Question: Enabling Contact Lens for Amazon Connect for specific calls

Is it possible to enable Contact Lens for Amazon Connect for specific calls? Contact Lens for Amazon Connect does what I need but I don't want to enable it for all calls.FollowComment

Answer: "1Accepted AnswerContact Lens is enabled by using the Set call recording behaviour action block. Therefore you can set based on attributes, % or any other datapoint your have.CommentShareDanBloyanswered 3 years ago"


Question: App Runner not adding custom domain names to ACM certificate

We recently deployed a new App Runner service and added two custom domain names and setup the DNS records as required. Both domain names are now showing Status: Active.When accessing the application using the App Runner provided URL everything works but when accessing via a custom domain we get a ERR_CERT_COMMON_NAME_INVALID error as the served certificate is only valid for *.<region>.awsapprunner.com.Is there something we might be missing? It seems like a bug and that the AWS managed ELB is not adding the certificates to it's listeners or adding the additional CNs to the certificate.FollowComment

Answer: 0Accepted AnswerThe issue was resolved by recreating the certificates a few times. Most likely a bug in the backend services.CommentSharerePost-User-7084652answered 3 months ago


Question: Gamelift and game state management?

"Hi!I've been (re)directed to this topic with one of my question from here https://forums.awsgametech.com/t/strategy-game-design/9703/2My question was about game state management. The idea is a multiplayer, small hexgrid based strategy game. So i have to store current game state somewhere(units, their stats, their interrelation, etc for both players). And since im very new to game design and AWS game tech too, i wonder how to design this.The game is mainly multiplayer, but i want to have single-player option as well. In single-player mode im not sure if server side state management is necessary and also how to integrate multi- and single player state management(maybe it is not practical to integrate them?).So is Gamelift really the place to put this state storage, management? If yes, how would you implement such thing?Thanks,lcFollowComment"

Answer: "0Accepted AnswerI can answer part of your question which is how to 'store' things when running on GameLift.GameLift offers a fleet instance role. Basically this role can be assumed in your code to call other AWS services including data stores like DynamoDB, S3 etc.You would need both an STS client and then access to whatever other clients you need ieServer knows the name of the role to assume (via config, fleet parameter etc)Call assumerole in codehttps://sdk.amazonaws.com/cpp/api/LATEST/class_aws_1_1_s_t_s_1_1_s_t_s_client.htmlEasier if you use a prebuilt like the STSAssumeRoleCredentialsProvider in the SDKPlug those credentials/credential provider into the client for the service you want to call and volia.As for your other points:single player mode - most likely you are going to use some local state storage for this. Its almost not worth using the 'cloud' here unless you want to offer networked features that require this ie:Leaderboards that reflect other players scoresAllowing players to start/stop and play across devices ie I can start on my phone, get home, change to my PC.Daily challenges etc.If theres nothing where people can 'compete' against others, then theres less incentive to cheat and so you can avoid a lot of the complexity/cost in your single player mode development path.For mutliplayer, typically you don't trust the client, they make requests to the server and it maintains state and decides if it should 'honor' the request. For storing the state a lot depends on what the state should be and what needs to persist beyond your 'session'; think about what the worst outcome of that session failing to complete could be.Theres are often written as two modes, but you could model your state manager as something that can be replaced dynamically ie in single player mode the state manager runs locally, in networked version it just a proxy that makes request <-> server, has local caches etc.Hopefully though you'll get more answers than that ;)CommentSharerePost-User-5332620answered 3 years ago0I never developed a server, have some understanding of REST APIs. So many things to think about and work out, but i think i got the grip on it with your answers. So thank you for that![quote="Pip, post:2, topic:9711"]Theres are often written as two modes, but you could model your state manager as something that can be replaced dynamically ie in single player mode the state manager runs locally, in networked version it just a proxy that makes request <-> server, has local caches etc.[/quote]Yeah, i want to have a unified solution for this. So for sure i'll need local storage in both cases, but in case of multiplayer match the server will be the single source of truth for state update.Of course i've got more questions after reading a bit more about Gamelift, but i think it's better if i ask them in separate threads.CommentSharerePost-User-0631075answered 3 years ago0[quote="lightconstruct, post:3, topic:9711"]I never developed a server, have some understanding of REST APIs. So many things to think about and work out, but i think i got the grip on it with your answers. So thank you for that![/quote]Hi,For this demand, GameLift can help you. It is important to keep in mind with the settings so that the costs are not high during the use and consumption of the tool. Take into account the scenario of having multiple players connected to justify using the right tool. Success in your project!CommentSharerePost-User-7328120answered 3 years ago"


Question: Cannot Find Solution to Project-level concurrent build limit cannot exceed the account-level concurrent build limit of 0 Error

"Hello all,In CodeBuild I have been trying to get a Build Project running but I keep running into the error "Project-level concurrent build limit cannot exceed the account-level concurrent build limit of 0." I have seen a couple of posts on this forum that either suggest to create non-root accounts or contact AWS Support. I have created non-root accounts but still receive the same error, and have contacted AWS Support but they instead redirected me to the same posts I have already seen or to ask here.Could I have some assistance on this matter?FollowComment"

Answer: "0The error message "Project-level concurrent build limit cannot exceed the account-level concurrent build limit of 0" means that your AWS account has a limit of 0 for the number of concurrent builds that can run at the same time.To fix this error and increase the concurrent build limit, you need to request an increase from Amazon Web Services (AWS) Support.Here are the steps to request an increase:Open the AWS Support Center: https://aws.amazon.com/support/Click on the "Create a new case" button.Fill out the case form, select "Service Limit Increase" as the category, and specify that you need an increase for the concurrent builds limit for AWS CodeBuild.Submit the form.AWS Support will review your request and get back to you with a resolution.CommentShareGabriel Olaleyeanswered 4 months ago"


Question: KCL1.x Java don't consuming records

"I am using KCL 1.14.8 for Java. My Kinesis only have one shard, and I put a record into Kinesis every 30 seconds. For each record, the RecordProcessor will process it, processing each record may take several seconds(<10 seconds).This is worker configuration.configuration.withInitialPositionInStream(InitialPositionInStream.LATEST)                .withRegionName("eu-west-1")                .withMaxRecords(10)                .withIdleTimeBetweenReadsInMillis(1000L)                .withCallProcessRecordsEvenForEmptyRecordList(false)                .withRetryGetRecordsInSeconds(1)                .withFailoverTimeMillis(60_000);When the application start, It don't consuming records at all.the logs show this:Aug 21, 2022 @ 21:24:14.943Skipping shard sync due to the reason - Hash range is complete.Aug 21, 2022 @ 21:24:14.785Number of pending leases to clean before the scan : 0Aug 21, 2022 @ 21:24:00.144Sleeping ...Aug 21, 2022 @ 21:24:00.144Current stream shard assignments: shardId-000000000000Aug 21, 2022 @ 21:23:14.911Elected leaders: xxxxx-187a-4ceb-9714-e39ab1c7bb71Aug 21, 2022 @ 21:23:14.785Number of pending leases to clean before the scan : 0Aug 21, 2022 @ 21:22:59.128Sleeping ...Aug 21, 2022 @ 21:22:59.128Current stream shard assignments: shardId-000000000000Aug 21, 2022 @ 21:22:14.937Skipping shard sync due to the reason - Hash range is complete.Aug 21, 2022 @ 21:22:14.785Number of pending leases to clean before the scan : 0Aug 21, 2022 @ 21:21:58.114Current stream shard assignments: shardId-000000000000Aug 21, 2022 @ 21:21:58.114Sleeping ...Aug 21, 2022 @ 21:21:14.785Number of pending leases to clean before the scan : 0please help.FollowCommentshawn 9 months ago".withLogWarningForTaskAfterMillis" help me find the issue. my processor is blocked by waiting another task finish.Share"


Question: Managed Blockchain and Cloud Storage

"Two questions. First, if you create a network on Amazon Managed Blockchain, then do you necessarily need to use AWS cloud storage? Or would it be possible to divide up the cloud storage among different providers? Second, Do all other members of an AMB network also need to use AWS cloud storage? If organization B wanted to join the network and insisted on using some other cloud storage provider, would it be possible for them to join the network? Or would the network operator need to launch a peer node on their behalf, using another AWS account?FollowCommentiwasa EXPERTa year agoHi.What do you mean by "AWS cloud storage"?Do you mean accessing with AWS S3 storage etc. with a chain code or smart contract?Or does it mean that the AMB node is booted with AWS compute resources?Share"

Answer: "1AMB is using AWS storage for Peer data and consensus. This is by design and we don't have plan to externalize storage. Beside security concerns, the performance of such architecture may be questionable.Each member of AMB network also get their own storage since their data is specific to their private channels. I believe what you are eluding to is this ability for non AMB members to join an AMB managed network, which is what AMB calls "Hybrid Networks". This is a roadmap item that we are seriously looking into. In the current state of things, you would indeed need to run a members/node for each participant. All with an AWS account.CommentShareJCanswered a year ago"


Question: AWS SSO integration with QuickSight

"A customer asks what information we need to enter on AWS SSO and on QuickSight to integrate the federated authentication. Unfortunately I can't find any documentation online. It seems like it is possible, but undocumented. Any information/examples would be appreciated.FollowComment"

Answer: "0Accepted AnswerWhen you add the Quicksight app in AWS SSO, there is an instructions page with everything you need. The URL is generic, but long as be damned. I've hyper-linked it, here.The Quicksight steps for configuring the service with SAML stands with AWS SSO, though. So there shouldn't be much issue from using those intructions either. If you or your customer find any issue with the instructions provided through the app in AWS SSO, then have them raise a support request with the AWS SSO service, explaining what steps are causing issue. Support will push the feedback on to the app team in AWS SSO and the instructions will be updated.CommentShareCiaran Carragheranswered 2 years ago"


Question: Can't update nucelus due to dependency

"Our group of devices are still running the nucleus component version 2.7.0. When we try to update, it seems like it gets in conflict with the greengrass.cli component, failing the deployment with the following error:NoAvailableComponentVersionException: No local or cloud component version satisfies the requirements.   [...] aws.greengrass.Cli requires >=2.5.0 <2.8.0, thinggroup/staging requires =2.9.5.However, the only deployment on that device does not have the greengrass.Cli component (it was removed a while ago). If I try to add the CLI component to the deployment with a newer version, it also fails with dependency errors:[...] Component aws.greengrass.Cli version constraints: thing/mything01 requires =2.7.0When I go on that thing's menu, I can see the component 'aws.greengrass.Cli v2.7.0 is listed with dependency type as "root" (with tooltip "This component is specified in a deployment that targets this core device"), but I can't see where this dependency is coming from and I can't remove it.If I can't see this dependency from the deployments to this devices, where else could it come from, and how can I remove it ?EDIT: greegrass was installed on the device using --deploy-dev-tools true, which may be related to the problemFollowComment"

Answer: "0Accepted AnswerHi,The second error you posted tells you what the problem is. You've deployed the CLI version 2.7.0 to the thing mything01 . You must remove the CLI from the thing's deployment, then you can deploy your update to the thing group. The issue is that you're using both thing and thinggroup deployments targeting the same device and then leading to this conflict.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered 2 months agoTSpark 2 months agoHi, thanks for the answer. I think this is the issue, but the problem I am having is that I do not have any direct deployment to this device, only "thinggroup" deployment. I can validate this information by looking at the "deployment" tab of the thing mything01, where only the group deployment shows up. I believe greengrass was installed on the device with the --deploy-dev-tools true, maybe this is what installed this component ?ShareMichaelDombrowski-AWS EXPERT2 months agoEven with that flag, that isn't magic, it just creates a deployment for you. Create a new deployment targeting the thing and make the deployment contain no components. This will remove the CLI from the thing's deployment.ShareTSpark 2 months agoThanks, that did the trick. Would have been great to be able to see that deployment on the dashboard. I can see the empty deployment on that device now, and it did remove the other invisible deployment.Share"


Question: Cloud watch Metric shows CPU utilisation as 600%

Cloud watch Metric shows CPU utilization for one of my ECS clusters as 600%I don't know how to interpret this info. Is the utilization really go above 100% if so there should be some scaling but there is no such scaling up activity.FollowComment

Answer: "1CpuUtilized metric - The CPU units used by tasks in the resource that is specified by the dimension set that you're using. Please refer here.It is not the percentage of CPU being utilized, but the number of CPU units being utilized. If you've set your CPU reservation value in your task definition, this metric will tell you about the number of units of CPU being utilized at a certain point in time.CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 8 months agovignesh 8 months agoIts a Fargate container, no reservation is set to this taskShare0The following AWS official document mentioned that CPU utilisation of ECS may exceed 100 %, which we hope will be helpful. [1][1] Amazon ECS CloudWatch metrics - Amazon Elastic Container Servicehttps://docs.amazonaws.cn/en_us/AmazonECS/latest/developerguide/cloudwatch-metrics.html#service_utilizationCommentSharemn87answered 8 months ago"


Question: not able to delete network interfaces linked with dead

"Hello,I'm not able to delete network interfaces which are still linked to dead EC2 instances: I have a "Network interface is currently in use." error message; it concerns the following ones:eni-09ed4eced1fe1524eeni-0c285e58524faf501Could you please help ?FollowComment"

Answer: "0Accepted AnswerGenerally you should not post the IDs of your ENI on re:Post because this is a public forum.That said, you do want to ensure you know what you are doing and not deleting ENIs that are needed by your application.If you do need to delete an ENI, that's say from a failed instance, you will be able to use theaws ec2 detach-network-interface --attachment-id <VALUE> --forceCLI command. [1]CommentShareJason_Sanswered a year ago"


Question: Can we use FSx for ONTAP as a storage of Amazon Nimble Studio?

"Amazon Nimble Studio says that "During the StudioBuilder process of creating your studio, you created an Amazon FSx file system. ", but actually FSx for Windows and Lustre mentioned in the following guide.https://docs.aws.amazon.com/nimble-studio/latest/userguide/update-storage.htmlFor Media Workloads like isual effects (VFX), animation, and interactive content, FSx for ONTAP seems to work well for it's High Performance and Cost Efficiencies.FollowComment"

Answer: "1I think it is possible to use it.We have an example of a movie creation using AWS Thinkbox Deadline and Amazon FSx for NetApp ONTAP.https://twitter.com/awscloud_jp/status/1596049926768582656?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E 1596049926768582656%7Ctwgr%5E116b8f5ac12e24f0452769e940bf1cd21d9c02fd%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fwww.itmedia.co.jp%2Fnews %2Farticles%2F2211%2F28%2Fnews131.htmlAWS Thinkbox Deadline is a service provided by Amazon Nimble Studio.As this is a case study response, we recommend that you get support and pre-build the system before actually using it.CommentShareTTTT1234answered 3 months agoYoshikiF 3 months agoYes, I am in Japan and know well the case of the one you put the link using EC2 for AWS Thinkbox Deadline and mount with FSx for ONTAP.But the Nimble Studio cannot choose FSx for ONTAP as an option of storage from the beginning of the release of it, and I sent the feature request for AWS support for this use case last August, but seems no progress in documentation at this moment.Share0Hi there, if you are looking for a high performance FSx option for Amazon Nimble Studio, i would leverage FSx for Lustre.CommentShareEXPERTGreg Vintonanswered 3 months agoYoshikiF 3 months agoThank you for checking it. Yes, FSx for Lustre is an option, but I would like to ask for FSx for ONTAP. In addition to Cost Efficiencies(Tiering/Deduplication/Compression/Compaction) I mentioned above, Hight Availability(SLA 99.99%/SLA99.9% for Single/Multi AZ), Agility by Cloning(FlexClone) and other features available for it.Share"


Question: is it possible to trigger a sagmamker pipeline execution via event bridge?

"I have a sagemaker pipeline code , currently run through a notebook , but i would like to hook it up to a evenbridge and trigger an execution. is it possible to do that , if yes, what permissions would i need and if there any samples of the event , that would be greatFollowComment"

Answer: "1Yes, it is possible to hook up a SageMaker pipeline code that is currently run through a notebook to an EventBridge and trigger an execution. To do this, you will need the following permissions:Amazon EventBridge Full AccessAmazon SageMaker Pipelines Full AccessOnce you have these permissions, you can create an EventBridge rule that triggers a SageMaker pipeline execution. The event that you use to trigger the execution can be any event that is supported by EventBridge. For example, you could use an S3 bucket event, a CloudWatch metric alarm, or a DynamoDB table change event.To create an EventBridge rule that triggers a SageMaker pipeline execution, follow these steps:Go to the EventBridge console.In the Rules list, click Create Rule.In the Create Rule wizard, on the Step 1: Define the rule page, do the following:For Rule name, enter a name for your rule.For Event pattern, select the event that you want to use to trigger the execution.For Target, select SageMaker Pipelines.For Pipeline name, select the name of the pipeline that you want to execute.For Parameters, specify any parameters that you want to pass to the pipeline.Click Next.On the Step 2: Configure details page, do the following:For State, select Enabled.For Description, enter a description for your rule.For Tags, add any tags that you want to associate with your rule.Click Create.Once you have created the rule, the next time an event that matches the event pattern occurs, the pipeline will be executed.CommentShareMarawan Mamdouhanswered a month ago0Once you have the pipeline built you can trigger the pipeline using Amazon EventBridge integration which supports both event based or schedule based events. Check the below link to setup using event bridgehttps://docs.aws.amazon.com/sagemaker/latest/dg/pipeline-eventbridge.htmlCommentShareArun Lokanathaanswered a month ago"


Question: FilterLogEventsRequest java sdk

I'm using the java sdk to filter cloudwatch logsFilterLogEventsRequest filterLogEventsRequest = FilterLogEventsRequest.builder().logGroupName(logGroupName).startTime(startTime).endTime(endTime).filterPattern().build();But i cannot get the correct format for the filter pattern since i'm trying to filter logs with urls such as http://someurl/someParameters/someOtherand i would like to get all those message that contains /someParameters/someOther for instanceThanks in advanceFollowComment