Question: Skillsbuidler subscription error

I can't subscribe to skill builder individual subscription. I keep getting this page.FollowComment

Answer: "0Have you tried using another account?CommentShareasad h1answered 18 days ago0No not tried it, does it mean I may have to open another root account?CommentSharerePost-User-2512054answered 17 days ago"


Question: Config Advanved Query Editor - Return ConfigRuleName

"I am using the AWS Config Service across multiple Accounts within my Organization. My goal is to write a query which will give me a full list of non-compliant resources in all regions, in all accounts. I have an Aggregator which has the visibility for this task. The Advanced Query I am using is similar to the AWS Example in the docs:SELECT  configuration.targetResourceId,  configuration.targetResourceType,  configuration.complianceType,  configuration.configRuleList,  accountId,  awsRegionWHERE  configuration.configRuleList.complianceType = 'NON_COMPLIANT'However, the ConfigRuleName is nested within configuration.configRuleList - as there could be multiple config rules, (hence the list)  assigned to configuration.targetResourceIdHow can I write a query that picks apart the JSON list returned this way? Because the results returned do not export to csv for example very well at all. Exporting a JSON object within a csv provides an unsuitable method if we wanted to import this into a spreadsheet for example, for viewership.I have tried to use configuration.configRuleList.configRuleName and this only returns - even when the list has a single object within. If there is a better way to create a centralised place to view all my Org's Non-Compliant Resources, I would like to learn about it.Thanks in Advance.FollowComment"


Question: "Many AWS Step Functions events in CloudTrail are considered "Management Events", but should be "Data Events""

"We use Step Functions pretty extensively in one of our applications.  I noticed higher than expected costs in CloudTrail and GuardDuty which caused me to investigate.It looks like every call to StartExecution, SendTaskHeartbeat, StartExecution, SendTaskSuccess, SendTaskFailure, etc are all considered "Management Events" inside CloudTrail.   Since all of these function are normal usage of the Step Functions service, I think they should be considered "Data Events" in the same way that regular "usage" of S3, Dynamo, and Lambda API calls are handled.By being considered "management events", they are causing a large number of events (and cost) in CloudTrail, and similar with GuardDuty.Below is a typical event caused by an API call to SendTaskHeartbeat, where you can see "managementEvent": true and     "eventCategory": "Management".  I believe this should be "managementEvent": false and     "eventCategory": "Data"{    "eventVersion": "1.08",    "userIdentity": {        "type": "AssumedRole",        "principalId": "xxxxxxxxxxxxxx-04fe38ef50d84dad1",        "arn": "arn:aws:sts::722537357562:assumed-role/my-role-name/i-x0x4xfxex3x8xex",        "accountId": "999999999999",        "accessKeyId": "ASIAXXXXXXXXXXXPB",        "sessionContext": {            "sessionIssuer": {                "type": "Role",                "principalId": "AROxxxxxxxxxxxxAGI",                "arn": "arn:aws:iam::999999999999:role/my-role-name",                "accountId": "999999999999",                "userName": "my-role-name"            },            "webIdFederationData": {},            "attributes": {                "creationDate": "2022-05-03T19:21:10Z",                "mfaAuthenticated": "false"            },            "ec2RoleDelivery": "2.0"        }    },    "eventTime": "2022-05-03T20:56:18Z",    "eventSource": "states.amazonaws.com",    "eventName": "SendTaskHeartbeat",    "awsRegion": "us-east-1",    "sourceIPAddress": "3.81.182.218",    "userAgent": "aws-sdk-php/3.183.13 OS/Linux/5.4.0-1030-aws GuzzleHttp/6.5.5 curl/7.68.0 PHP/7.4.3",    "requestParameters": {        "taskToken": "AAAAKgAAAA......AqHoA+2qxXBI="    },    "responseElements": null,    "requestID": "999999999-81de-40bf-8b77-7ccbf0db5fb4",    "eventID": "999999999-2193-47dd-8e3d-10a5d9e6266d",    "readOnly": false,    "eventType": "AwsApiCall",    "managementEvent": true,    "recipientAccountId": "999999999999",    "eventCategory": "Management",    "tlsDetails": {        "tlsVersion": "TLSv1.2",        "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",        "clientProvidedHostHeader": "states.us-east-1.amazonaws.com"    }}FollowComment"


Question: Lumberyard 1.9 with new visual scripting language is full source code just like UE4?

"Lumberyard 1.9 with new visual scripting language is full source code just like UE4?I mean , We can develop Lumberyard sandbox just like UE4 ?We know , CryEngine 5.x is not full source code ,and , do not exist source code sandbox in the github :and lumberyard is full source code or not??please see this reports :https://answers.cryengine.com/questions/4762/75-error-same-vs-2015-compile-source-code-and-sour.htmlhttps://answers.cryengine.com/questions/4732/73-errorvs-2015-compile-source-code-and-source-sdk.htmlFollow"

Answer: "0Accepted AnswerHi @REDACTEDUSERThe new Script Canvas will not be available in Lumberyard 1.9, it is shipping in 1.10.It is a more robust, scalable and efficient version of Flow Graph that is in the current versions of Lumberyard and will interact fully with component entities.Full source code is supplied.Regarding VS2015 ... it is fully supported and will build with the latest updates to the product.SharerePost-User-5084441answered 6 years ago0new Script Canvas is visual scripting language like as blueprints UE4??SharerePost-User-8224505answered 6 years ago0This kind of informations given randomly in the forum makes the lack of any kind of roadmap even more evident.So thanks to Ahmad for asking and Chris for answering and less thanks for who decided for no public roadmap policy.Sorry about the polemic tone , but the random acquisition of sparse info about the releases is a quite old pain point of this community.About very early cutting edge features other system employ a way to enable or disable them.Maybe it's not a bad idea to release something early but still disabled by default.SharerePost-User-7621041answered 6 years ago0Having had little experience of Blueprints and only initial tests of Script Canvas I cannot really comment. However it is possible to write complete game play in Script Canvas and/or Lua.SharerePost-User-5084441answered 6 years ago0so we do not see visual scripting language in lumberyard 1.9 and 1.10 , no?SharerePost-User-8224505answered 6 years ago0There is visual scripting in all versions of Lumberyard, FlowGraph. This does not work with all the new component entity types. The new version will be in future versions of the editor. For now I would recommend using Lua.SharerePost-User-5084441answered 6 years ago0thanks a lotSharerePost-User-8224505answered 6 years ago0Gamely thanks , but I think , we do not see visual scripting like as Blueprint UE4 in lumberyard , here is not roadmap ,here is not visual scripting language,here is not delete flowgraph!!!I think , better I use of CryEngine, of course CryEngine 5.3 is not Full Source Code , I think , better I use of Lumberyard ,etc !!!this is a bad cycle!!!SharerePost-User-8224505answered 6 years ago0Hang in there, we are actively working on the new visual scripting system that I think you will really like, it's just not quite ready for 1.9.SharerePost-User-8353690answered 6 years ago0Hi Dear Binky , thank you so much for answer , I'm very glad for this news , also I regret the time I left Lumberyard.But I'm glad I turned out to be fake and phony of Crytek.Soon I will publish other documents from Crytek misuse of users.SharerePost-User-8224505answered 6 years ago0Thanks. Is there any sort of ... I know I shouldn't say it... timeline on a version with the new scripting system? We are currently trying to understand how Lumberyard works in anticipation of starting a new project, and it would be better if we could avoid duplication of effort in across the old system and the new.It looks like there have generally been 1-2 months between releases recently, and we are about 2 months from the most recent release. Obviously you can't make any promises, or say anything that sounds like a promise... but does it make sense to try and push our script development forward a month or two?SharerePost-User-6682533answered 6 years ago0Hey @REDACTEDUSERSorry I can't give you more concrete information right now.SharerePost-User-8353690answered 6 years ago0Hey Dear Binky ,flownode visual scripting autodesk stingray is not Independent, we can not make games with flownode visual scripting in stingray , we must use flownode and lua(both) in stingray for creation games.Binky is possible tell us , new visual scripting in lumberyard 1.9 is Independent c++ and lua?? or like as flownode visual scripting in the autodesk stingray dependent lua??thanks a lotSharerePost-User-8224505answered 6 years ago0Hey Dear ChrisDB,flownode visual scripting autodesk stingray is not Independent, we can not make games with flownode visual scripting in stingray , we must use flownode and lua(both) in stingray for creation games.Binky is possible tell us , new visual scripting in lumberyard 1.9 is Independent c++ and lua?? or like as flownode visual scripting in the autodesk stingray dependent lua??thanks a lotSharerePost-User-8224505answered 6 years ago0Is it possible to get an ETA for when it will be released? My team is currently leaning towards Unreal Engine 4 because Lumberyard doesn't quite have its visual scripting ready yet.SharerePost-User-0869499answered 6 years ago0I know , "Script Canvas" Visual Scripting in lumberyard will be published this summer , but I hope this new language , Independent of C++ and Independent of Lua , just Like Blueprint UE4 that is Independent of C++ CompleletelySharerePost-User-8224505answered 6 years ago0Hi Amazon Team / @AhmadKarami,1.10 has been released but no "Script Canvas" included. Script Canvas is very important to proceed with the switching from UE4 to Lumberyard.Can you share with community any new ETA or info?Thanks,SharerePost-User-0381819answered 6 years ago0Hey @REDACTEDUSERSharerePost-User-5738838answered 6 years ago"


Question: Protection of On-Premises with traffic only routed through TGW-VPN-> Network Virtual Appliance -> Internet.

"We want to implement an architecture such that we connected different physical sites (On-Premises * 10) to the internet through a transit gateway and having inspection by a network virtual appliance (Sophos). This will also allow the physical locations to communicate with one another.The idea is to have routers on premises that only send/receive traffic through the VPN connection, all other traffic is denied.I want to know if this setup is secure in general. Though all traffic flows this way, will it be protected from, for example, DDoS attacks on premises. AWS side of things can be protected by the firewall as well as maybe Shield Advanced but the on-premises networks.Is there a need to protect them as well or a Microtik router for example with free updated is enough, as they are connected to the internet through public IPs.FollowComment"

Answer: "0As you said on premises traffic will come through AWS VPN tunnel to AWS then TGW then Sophos Filtering appliance, out to NatGateway(you need it or do NAT on sphos itself) then out internet through IGW .On prem host--->On prem router--->VPN --->TGW--->Appliance Sophos-->NAT on Sphos or NatGateway--->IGW--->internet.comIn this scenario, external facing IP towards internet will be either Sophos EIP or NatGateway EIP which is AWS IP and will be protected from DDOS Attacks in general.Also VPN tunnels will be built between your on prem device public IP and TGW VPN End points , so it will be protected with Shield DDOS service as well.In this traffic flow, there is no way an external party can ddos on prem. External party only see AWS outgoing elastic IP and thats the only thing someone can attack.Hope this helps.CommentShareMuhammadanswered 4 months ago"


Question: How Amazon Personalize treat the Explicit Impression data in real time using PutEvent

"We using Amazon Personalize to build some real-time recommendation model. We used the explicit impression data. A quick question we have is: when we are using the PutEvent to record the live Event, will Amazon Personalize adjust the recommendation immediately and demote or filter out those items that are not interacted in the impression data? In short, does sending impressions with PutEvents affect the recommendation for the same user immediately?FollowComment"

Answer: "0Real-time events recorded using PutEvent will affect the recommendations within seconds if your application calls Personalize again to generate new recommendations for that user. Impression data, which the user did not interact with, included in PutEvent will decrease the chance of those products appearing in the recommendations again.CommentShareS_Mooseanswered 2 months ago"


Question: Regarding how to do survey with Google forms

"Hello, I have read an instruction and followed all the way it guides.However, my google form link is not working with MTurk with this message: "Layout does not contain any fields for Workers to provide responses. Please include at least one field (input, select, or textarea)"Could you help me address this issue?Thank you.FollowComment"


Question: Failed registration of new domain

"Hello,I have been trying to register a new domain name but receive an email to tell me that they were unable to register the domain because they couldn't finish registering it and I should contact support.If it is about validating my account, can you do this ASAP?Thanks,FollowComment"

Answer: "0I suggest contacting the domain registrar's customer support team to inquire about the issue and ask for assistance. They will be able to help you troubleshoot and resolve the issue. Be sure to provide them with any relevant information or error messages that you have received.If you're not sure which domain registrar you used, you can check the WHOIS database to see who the domain is registered with. You can also check your email for any communication from the domain registrar.CommentSharehashanswered a month ago"


Question: Updating Amazon Linux 2 packages selinux-policy and selinux-policy-targeted

"I'm trying to install snapd on my system, but when running **yum install snapd ** I get the following error:Error: Package: snapd-selinux-2.54.1-1.el7.noarch (epel)Requires: selinux-policy-base >= 3.13.1-268.el7_9.2While there are various packages that provide selinux-policy-base, the latest version available seems to be: 3.13.1-192.amzn2.6.7, not the required 3.13.1-268. However, according to the Amazon Linux 2 release notes (https://aws.amazon.com/amazon-linux-2/release-notes/), the Amazon Linux 2.0.20211201.0 Update should provide both selinux-policy-3.13.1-268.amzn2.2.2.noarch and selinux-policy-targeted-3.13.1-268.amzn2.2.2.noarch.My understanding is that Amazon Linux 2 should do an in place upgrade simply by running yum upgrade, but I've tried this to no avail. What's also interesting is that other packages in the Amazon Linux 2.0.20211201.0 Update are available. For instance nspr-4.32.0-1.amzn2.x86_64 and nss-softokn-3.67.0-3.amzn2.x86_64 are both there.How do I get the latest Amazon Linux versions of selinux-policy-base and selinux-policy-targeted?FollowComment"

Answer: "0Amazon Linux 2 does not support SELinux. Amazon Linux 2022 (now in preview) and Bottlerocket both support SELinux, though.I do not believe AL2 supports snapd, either.CommentShareEXPERTMichael_Fanswered a year ago"


Question: How to get QuickSight dashboard usage and access data to analyze metrics on the dashboard itself?

"We require QuickSight dashboard usage and access data to analyze metrics on the dashboard itself and send out reports scheduled to send automatically via email.Can anyone help us to get usage and access data from Quicksight and setup the dashboard usage and access summary?FollowCommentSanjeeb 3 months agoYou can collect all quicksight events via cloudtrail and save into S3. Once the data is written to S3, either custom program ( using python) or Athena can be used to filter quicksight events and understand the dashboard usage and summary. This is a custom solution followed by many organization.  For filtering only specific region, you need to create trail via cli .Share"

Answer: "0I found a (Japanese) site that might answer your question.https://dev.classmethod.jp/articles/visualize-amazon-quicksight-api-logs-with-quicksight/The steps are below:Enable CloudTrailQuickSight permission settings for AthenaCreate Athena TableYou can create a table from the CloudTrail console ( I used to run a query to create a table from the Athena console ).Create Dataset on QuickSightThere is a SQL sample on the following sitehttps://dev.classmethod.jp/articles/count-quicksight-access-with-athena-and-cloudtrail/I was using the below querySELECT  date  ,eventtime  ,eventname  ,useridentity.username AS username   ,json_extract_scalar( serviceeventdetails, '$.eventResponseDetails.dashboardDetails.dashboardName' ) AS dashboardName  ,json_extract_scalar( serviceeventdetails, '$.eventResponseDetails.analysisDetails.analysisName' ) AS analysisNameFROM "logs"."cloudtrail_logs"WHERE  region = 'ap-northeast-1'  AND eventsource = 'quicksight.amazonaws.com'  AND eventname in ( 'GetDashboard','GetAnalysis');Create a graphI have graphed the number of users by date as in the image belowCommentShareARBRanswered 3 months agoEXPERTiwasareviewed 3 months agoSanjeeb 3 months agoGood solution and we also followed the same but instead of Athena, we used our custom spark on EMR and developed this as we used EMR for our big data processing.Share"


Question: possible bug in awsiotsdk python ?

"I have a function:def get_thing_shadow_request(thingName, shadowName):try:    ipc_client_shadow       = awsiot.greengrasscoreipc.connect()      get_thing_shadow_request = GetThingShadowRequest()      get_thing_shadow_request.thing_name = thingName      get_thing_shadow_request.shadow_name = shadowName      op = ipc_client_shadow.new_get_thing_shadow()      op.activate(get_thing_shadow_request)      fut = op.get_response()      result = fut.result(10)      return result.payload  except BaseException as err:      g_logger.error("EXCEPTION get_thing_shadow_request  thingname {}, shadowname {} error {} ".format(thingName, shadowName, err))      return ""  that i call multiple times and it works fine. however on the 1023rd call ( this seems awfully close to a 1024 magic number btw) of this function it stops working with the following error:EXCEPTION get_thing_shadow_request count:1025, thingname smartdvr-1423019132001, shadowname streamcontrol error 46 (AWS_ERROR_SYS_CALL_FAILURE): System call failureone other note is that 1 out of 3 of my calls is asking for a shadow that doesn't exist (i'm checking to see if it exists and if it fails i know it doesn't)i can't see anything unusual in greengrass.logEdited by: clogwog on Dec 2, 2021 12:14 PMFollowComment"

Answer: "0Accepted AnswerHello,Looks like you're calling connect inside the method, so that means that you're calling connect 1023 times and thus creating 1023 threads and socket connections.You should only ever connect one time and then reuse the client for all future calls. This should resolve your issue as well as be more efficient and fast.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered a year ago0Well...if you put it like that.... yes.. this is less than optimal :)thank you Michael! It all works well now.TomCommentShareclogwoganswered a year ago0Tom,I'm very glad to hear that solution worked for you.Have a great day.Cheers,MichaelCommentShareEXPERTMichaelDombrowski-AWSanswered a year ago"


Question: How we can apply Alerting on AWS Networking resources

"Dear Team,I am planning to apply the HEALTH CHECK Alert on following recourses of AWS.Virtual Private Clouda. Public Subnetb. Private SubnetInternet GatewayNAT GatewaySecurity GroupsI have search and did not found any useful help.Appreciated your kind support.ThanksMalik Adeel ImtiazFollowComment"

Answer: "0Thank you so much Gurus, for your reply.Please see that if any outage occur in any AWS Services in any Region we will not receive any email for that. Until Client or / End User complaint us that there app is not working (irrespective of what services they are using). We need to check the application first.Then open this link -->> https://status.aws.amazon.com/govcloudAnd need to check the service manually that it is working fine in the region from where client has logged a complaint.So main focus was to configure the alert on below services.Virtual Private Clouda. Public Subnet b. Private SubnetInternet GatewayNAT GatewaySecurity GroupsSo that if these services got some outage we can get the Alert on Email.CommentShareimtiazaanswered 4 months agoBrettski-AWS EXPERT4 months agoAs per my answer: Some of those things you can't monitor directly. Doing end-to-end monitoring will ensure that your entire service is working as well as (by proxy) ensuring that the services you want to monitor are working correctly. You can't check a VPC or subnet to see if it is working - it isn't a valid question for that type of construct. Even on premises you can't check to see that a subnet is working - you have to check connectivity to something on that subnet. Same applies here - check to see that your application is working correctly and you've proven the other things.Share0Since you didn't mention what metric you would like to cover, I will just provide the documentation and maybe we can help you more once you provide additional info. Do you want only to check that it is available or anything else?VPC - https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cloudwatch.htmlNAT GTW - https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway-cloudwatch.htmlSecurity groups - https://aws.amazon.com/premiumsupport/knowledge-center/monitor-security-group-changes-ec2/What is it you want to monitor with Internet GTW? You can use AWS Config , for example - https://docs.aws.amazon.com/config/latest/developerguide/internet-gateway-authorized-vpc-only.htmlNot sure if helpful but this https://wellarchitectedlabs.com/reliability/300_labs/300_health_checks_and_dependencies/ LAB can provide additional insight to you.Let us know what's your use case so we can a little dive deeperCommentShareNikoanswered 4 months ago0Many of the resources you've mentioned are virtual and not built using a single "thing" which makes performing health checks difficult. I will attempt to answer the question though.If you can connect from an instance in that VPC to another instance in the VPC then the VPC is working. This is true for both private and public subnets. I would suggest setting up some sort of network probe (Lambda would be ideal for this) that emits a metric to your monitoring tool (CloudWatch Metrics would suit here).Similarly, if you can connect to an external (public) IP address from within your VPC or you can connect to an Elastic (or Public) IP connected to your VPC from an external source then the Internet Gateway is working.Same as (1) and (2) - except this time ensure that the network probe is on a private subnet and it is probing an external resource that must be reached via the NAT Gateway.Security groups aren't a physical firewall; they are (more or less) a property of the instance. You can check to see if the security group is operating correctly by probing ports that should be open (to confirm that they are open); and probing ports that should be closed (to confirm that they are closed). You might also use VPC Reachability Analyzer for this although it doesn't send probes - instead it uses automated reasoning to determine if your security groups are configured correctly.With all of that said: In my opinion performing these health checks are not a good way to spend your time (or money). Instead, I would be building monitoring that is looking at the health and response times of the applications that are hosted in the VPC. This has the side effect of ensuring that all the other components are working correctly but also gives you greater visibility into what your end-users are experiencing. You might also consider CloudWatch Real-User Monitoring for this task.CommentShareEXPERTBrettski-AWSanswered 4 months ago0I agree with previous answers this isn't the place where you should start building monitoring and observability. Most of these resources don't have meaningful metrics or healthchecks. If you are interested in NAT GW's performance and availability, here is one implementation for your inspiration.https://cloudonaut.io/nat-gateway-monitoring-with-cloudwatch-metrics-and-alarms/And there is also (in preview) CloudWatch Internet Monitor to see what happens on the internet between end-users and your AWS infrastructure.https://aws.amazon.com/blogs/aws/cloudwatch-internet-monitor-end-to-end-visibility-into-internet-performance-for-your-applications/CommentShareKalluanswered 4 months ago"


Question: Lambda function unable to execute CreateAlias on CMK

"A customer would like to create customer master keys (CMK) in KMS across all AWS regions. They would also like to use same alias for their CMKs across regions. In order to do that they have a CloudFormation template. But the CloudFormation does not support specifying a key alias http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-key.htmlThey looked at using CustomResource within CloudFormation to invoke a Lambda function. The function takes the key-id and the alias name than tries to apply the alias on the given key-id. Unfortunately the lambda does not have access to execute CreateAlias or any KMS API. It appears the KMS specific Key policy does not have a way to specify lambda ARN, it currently only supports an IAM user or IAM role.I would like to know if someone else has faced similar problem in the past and if so what were your workaround/solution to it? Also please do suggest if we are missing any documentation or feature or best practice that is already available to accomplish the use case above.FollowComment"

Answer: "0Accepted AnswerThere is a workaround to grant permissions to assumed-role users by usingthe aws:userid Policy Variable and [IAM Policy Conditions] (http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#Condition).  The approach is outlined in this AWS Blog post.KMS/Lamba-Specific Approach:Create a new Role to act as the execution role for Lambda. (e.g. lambda_test_kms_execution)Make sure to give the Execution role permissions to create the alias:{            "Effect": "Allow",            "Action": "kms:CreateAlias",            "Resource": "*"        }Use the AWS CLI to get the Unique RoleId for the role:aws iam get-role --role-name lambda_test_kms_executionAssume the output contains "RoleId": "ARO1234567890"Add statement(s) to the KMS key policy that use Condition to match aws:userid against the unique RoleId:{   "Sid": "Deny IAM User Permissions",   "Effect": "Deny",   "Principal": { "AWS": "*" },   "Action": "kms:CreateAlias",   "Resource": "*",   "Condition": {     "StringNotLike": {       "aws:userid": "ARO1234567890:*"     }   } }CommentShareAWS-User-0882354answered 7 years agoEXPERTsdtslmnreviewed 9 days ago"


Question: SQS has occasional message latencies of up to 5 minutes

"I have been using SQS (in ap-northeast-1) for years now, but recently I have started noticing within my application logs that a small fraction of my message deliveries have a latencies of up to 5 minutes. I would say 99.9% of the messages are delivered within <1s, but my application is sensitive to these occasional delays. I was wondering what is the AWS SLA for SQS messages latencies once they have been received by SQS to be sent to the registered receiver and if there is a way to minimize the occasional 5 minute latencies on the 0.01% of the messages.Is moving to AWS MQ or running my own message broker the only solution? I don't really need all the advance features the former provides, I just need SQS to be 100% reliable and consistent when it comes to delivery latency.FollowComment"

Answer: "1Thank you for the link to the SLA, but it only talks about uptime, for which there was no downtime because the message was received by SQS and eventually delivered, albeit after 5 minutes. I was referring to message latency SLAs. For example SQS agrees to deliver all received messages that has no delay specified within 3s or something to that extent.I would raise a support case too, except that I'm on the basic support plan and I cannot open technical support cases. I could pay 3% of my billed amount to upgrade my support plan, but I don't really need any technical guidance. I just would like to know if this is a bug/issue on SQS and report it in hopes it would get resolved. I would be happy to provide a few relevant message IDs so a technical support specialist can investigate further.So far, no errors. No downtime notices on my personal health dashboard and no errors from SQS. I have other messages on other queues being processed and other messages on the same queue coming in just fine.CommentSharekgstonanswered a year ago0Are you seeing any errors when the delays occur? FYI the SQS SLA is on our website.In this case I would raise a support case; talk the team about when this is occurring and try to determine what the root cause is.CommentShareEXPERTBrettski-AWSanswered a year ago0I agree with @kgston and there is no mention of response time or latency in the SLA link. Amazon talks high about SQS scalability but this doesn't make sense if low latency can't be guaranteed.For several of our SQS usages in Asia Pacific (Mumbai) / ap-south-1 we are experiencing such high latencies (b/w 1 to 5 min) for approx 1% of send requests.About 10% would range in 500ms to 1s and this is when using connection pool. It is desirable to have a guarantee of under 300ms at least.CommentShareIamPankajJanswered 4 months ago"


Question: QnA Chatbot not recognizing some questions.

"I was making a chatbot for a Japanese company and was using the QnAbot to create it. I imported all the questions and answers on the QnAbot Designer.After trying to test the chatbot using QnAbot Client, I found that even though the question exists on the Designer, it does not seem to give me a response. Some words seem to work, while the majority do not, without any sort of pattern. I am not certain what is causing the issue. For example,These works:アクセス権限マトリクス一覧表申請方法（スマホ内線）These do not work:早期退職通達（スマホ内線）They are similar yet one works, while the other does not.In total, there are around 500 questions and answers.  Is it the Japanese characters? I am not certain.FollowComment"

Answer: "0Accepted AnswerI was able to solve it.The problem was the format of the answer (it was in code form). After removing the code portion, it workedCommentShareAWS-User-0900884answered a year ago"


Question: How to access aws quicksight dashboard via aws iam role only ?

"Hi,I have setup quiksight dashboards and i want to share them with only via aws iam role. I don't want to create quicksight user. Users has access to my aws accounts and I need to add role to access quicksight with reader role.Please help!!FollowComment"

Answer: "0You can invite IAM users in your AWS account to use Amazon QuickSight. In this case, they can use their IAM credentials to sign in to Amazon QuickSight. Any IAM user you invite must have a password associated with their IAM credentials, and you must also have an email address for them.Visit Inviting users to access Amazon QuickSight for more information.CommentShareBriNasAWSanswered 15 days ago"


Question: Logs generated by Lambda Functions

How can I check the amount of logs generated by the Lambda function? I need to find the functions that are generating logs more than or equal to 500 MB.FollowComment

Answer: "1You can query the CloudWatch Logs API and see how much storage each log group is consuming: aws logs describe-log-groupsFor each log group the output will look like:"logGroupName": "/aws/lambda/FunctionName","creationTime": 1573030762692,"metricFilterCount": 0,"arn": "arn:aws:logs:region:accountnumber:log-group:/aws/lambda/FunctionName:*","storedBytes": 148153072CommentShareEXPERTBrettski-AWSanswered a year ago"


Question: dms create replication task SYSTEM ERROR MESSAGE:An internal error

"Issue- Can not create a new replication task from either the console or aws cli.DetailsSource - Aws RDS postgres version 10Target - Aws Redshift cluster with 4 nodesBoth the source and target are in same VPC, there are 5-6 tasks running already which seem to be working fine.I have tested the endpoint connection for the new task beforehand, it shows successful.Errors:Console error : SYSTEM ERROR MESSAGE:An internal error has occurred. Please try your query again at a later time.aws cli --debug error:2021-01-13 00:26:00,174 - MainThread - botocore.parsers - DEBUG - Response headers: {'x-amzn-RequestId': '0975d842-34b5-455f-be83-f2aed1f301a0', 'Content-Type': 'application/x-amz-json-1.1', 'Content-Length': '117', 'Date': 'Tue, 12 Jan 2021 18:55:59 GMT', 'Connection': 'close'}2021-01-13 00:26:00,174 - MainThread - botocore.parsers - DEBUG - Response body:b'{"__type":"InternalFailure","message":"An internal error has occurred. Please try your query again at a later time."}'This error message is completely opaque can not figure out where to look. Please help.ThanksFollowComment"

Answer: "0Hi,For anyone in future I did not change anything. I tried creating the task in morning it got created and data is synced.CommentSharemanncueanswered 2 years ago"


Question: Help: fpga-clear-local-image not found

"I am following the HDK getting started guide, in particular I am trying to execute the " https://github.com/aws/aws-fpga/blob/master/hdk/README.md#how-to-create-an-amazon-fpga-image-afi-from-one-of-the-cl-examples-step-by-step-guide" for the hello world example.I have successfully executed the first part - building the custom logic and publishing my new AFI. I have obtained the AFI ID and the AGFI ID. I have confirmed by executing aws ec2 describe-fpga-images  my AFI is available and I have verified it is in the bucket.The second part of the guide is about "how to load and test a registered AFI from withing an F1 instance".I have created an f1.2xlarge instance using the Centos FPGA Developer AMI. The welcome message is> login as: centos  > Authenticating with public key "imported-openssh-key"  > Last login: Thu Feb 25 15:40:14 2021 from 72-21-196-65.amazon.com  >   ___ ___  ___   _     ___  _____   __    _   __  __ ___  >  | __| _ \/ __| /_\   |   \| __\ \ / /   /_\ |  \/  |_ _|  >  | _||  _/ (_ |/ _ \  | |) | _| \ V /   / _ \| |\/| || |  >  |_| |_|  \___/_/ \_\ |___/|___| \_/   /_/ \_\_|  |_|___|  >  AMI Version:        1.10.0  >  Xilinx Version:     2020.2  >  Readme:             /home/centos/src/README.md  >  AMI Release Notes:  /home/centos/src/RELEASE_NOTES.md  >  GUI/Cluster setup:  https://github.com/aws/aws-fpga/blob/master/developer_resources  >  Developer Support:  https://github.com/aws/aws-fpga/blob/master/README.md#developer-    support  >  Centos Common code: /srv/git/centos-git-common  >  Xilinx XRT source:  https://github.com/Xilinx/XRT  Now, the instructions read:> git clone https://github.com/aws/aws-fpga.git $AWS_FPGA_REPO_DIR  > cd $AWS_FPGA_REPO_DIR  > source sdk_setup.sh  (small aside: it would be best IMHO to provide the snipped with the definition of $AWS_FPGA_REPO_DIR again; the wording instructs to launch a new VM so I think definition cannot be assumed).So far everything look ok.I also ran aws configure as instructed.OK.Next step would be sudo fpga-clear-local-image  -S 0This is what happens in reality:> \[centos@fpgadevc aws-fpga] sudo fpga-clear-local-image -S 0  > sudo: fpga-clear-local-image: command not found  Related FPGA commands don't seem to work either. I don't really know where to find them but I was more focused in going by the book for now. I have tried to understand why those commands don't work and I am so far out of clues. What did I miss?Edited by: MaxDZ8 on Jul 4, 2021 9:02 AM - fix some layoutEdited by: fixed more formatting woes.FollowComment"

Answer: "0Dear customerThank you for contacting AWS. Can you please verify if you re-ran source sdk_setup.sh on your F1 instance before running the calls to FPGA specific functions.ThanksCommentShareAWS-User-7905434answered 2 years ago0Hello thank you for helping.I connected and ran:> cd src/project_data/aws-fpga  > source sdk_setup.sh  Then> \[centos@ip-172-31-41-160 ~]$ sudo fpga-describe-local-image-slots  > AFIDEVICE    0       0x1d0f      0xf010      0000:00:1d.0  Wow! It works! Thank you!What did it go wrong? Maybe I forgot to call the script?I have looked at the bash history and it indeed was there (???) well, I'll just move on. Kudos!CommentShareMaxDZ8answered 2 years ago"


Question: cannot access list of accounts

I have recently spent some time away from amazon aws due to medical problems. Now I cannot login to my accounts so I created a second one. Is there anyway that I can access my accounts when all I know is the names of buckets?many thanks  TonyFollowComment

Answer: "0Hi Tony,I would suggest to check the following guide that help you getting access when your credentials do not work: https://aws.amazon.com/premiumsupport/knowledge-center/forgot-aws-sign-in-credentials/Hope it helpsCommentShareEXPERTalatechanswered 4 months ago"


Question: AWS Skill Builder subscription on behalf of another user on the same account

"My company has approved my obtaining a full year individual subscription to AWS Skill Builder.   How does the person with access to the root account purchase a subscription so that I can use it, rather than they?The person approving the request has access to the root user and I am a regular user under the same account.FollowComment"

Answer: "1Individual subscriptions cannot be used by more than one person.You must purchase individual subscriptions for the number of people or team subscriptions.https://aws.amazon.com/jp/training/digital/team-subscription/?cta=tdtopbannerIf this answer leads to a resolution, please approve the answer for the betterment of the community.CommentShareEXPERTRiku_Kobayashianswered a month agorePost-User-4326119 a month agoThat doesn't quite answer the question.  We only want one individual subscription to be used for exactly one person.I cannot purchase it directly because I don't own the root account.  The person with the root account is not the person who needs to actually use the subscription.A team subscription isn't appropriate here since we have less than 50 team members.  The instructions on the site say:Want to train fewer than 50 employees?  Check out our Individual subscription or free digital training.ShareRiku_Kobayashi EXPERTa month agoSorry.Please purchase as root user as it is not possible to purchase as IAM user.Once purchased, a purchase history email will be sent to the root user's email address and can be used once received.SharerePost-User-4326119 a month agoOnce an individual learning subscription is purchased by the root user, can a single IAM user then use the subscription?  This is problematic if I now need to use the root user's account to access my subscription.   My company is an AWS partner and I have my employee account under that partnership.Share"


Question: Host a fine-tuned BERT Multilingual model on SageMaker with Serverless inference

"Hi All,Good day!!Key point to note here is, we have pre-processing script for the text document, deserialize which is required for prediction then we have post-processing script for generating NER (entitites).I went through SageMaker material and decided to try following options.Option 1: Bring our own model, write a inference script and deploy it on SM real-time endpoint using Pytorch container.I went through Suman video (https://www.youtube.com/watch?v=D9Qo5OpG4p8) which is really good, need to try with our pre-processing and post-processing scripts then see if it works fine or not.Option 2: Bring our own model, write a inference script and deploy it on SM real-time endpoint using Huggingface container.I went through Huggingface docs (https://huggingface.co/docs/sagemaker/inference#deploy-a-%F0%9F%A4%97-transformers-model-trained-in-sagemaker) but there is no reference for how to use own pre and post-processing scripts to setup inference pipeline.If you know any examples on using our own pre and post-processing scripts using Huggingface container then please share it.Option 3: Bring our own model, write a inference script and deploy it on SM Serverless inference/endpoint using Huggingface container.I went through Julien video (https://www.youtube.com/watch?v=cUhDLoBH80o&list=PLJgojBtbsuc0E1JcQheqgHUUThahGXLJT&index=35) which is excellent but he has not shown how to use our own pre and post-processing scripts using Huggingface container.Please share if you know any examples.Could you please help?Thanks,VinayakFollowComment"

Answer: "0Hi Vinayak, thanks for opening this thread.This is the official documentation and describes how the inference script for pre and postprocessing should be structured: https://huggingface.co/docs/sagemaker/inference#user-defined-code-and-modules.And here a simple example of an inference script with pre and postprocessing: https://github.com/marshmellow77/text-summarisation-project/blob/main/inference_code/inference.pyHope that helps, please reach out in case of questions.ThanksHeikoCommentShareHeikoanswered a year ago"


Question: "Confused about permissions in IOT Core/PubSub/Shadows, Greengrass, IAM roles, service roles and IPC."

"I have a few questions here as I am very confused. There seems to be quite a few areas where permissions need to be set up. I have a deployment that uses Auth, Bridge, ShadowManager and a custom component. The custom components can publish but I am having issues reading a shadow. There are also entities like IAM roles and policies in addition to something called a service role and something referred to as IPC or Inter Process Communication.I have an issue here that I am trying to resolve but find myself confused about what I am setting where when I am setting permissions.Is there someone who has the time and kindness to write a easy to understand, plain language tutorial or summary of what all these permission configurations are? Hopefully it would be clearer.FollowComment"

Answer: "1Accepted AnswerThere are several different policies and it can be tough to understand what goes where, but understanding the various resource types and their scope can help.Greengrass components access resources through IPC. IPC resources are local to the Greengrass device. The "principal" accessing those resources is the component itself. You can give components the necessary permissions in the component configuration.https://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.htmlhttps://docs.aws.amazon.com/greengrass/v2/developerguide/interprocess-communication.html#ipc-authorization-policiesSome IPC resources map to resources which exist in AWS IoT (e.g. Shadows, MQTT topics). The Greengrass core device is the "principal" which accesses those resources. For those, you need to give Greengrass permission in the IoT Policy which is attached to the Greengrass core certificate. You would configure the IoT Policy for anything your component accesses using the IoT Device SDK.https://docs.aws.amazon.com/greengrass/v2/developerguide/device-auth.htmlhttps://docs.aws.amazon.com/iot/latest/developerguide/iot-policies.htmlhttps://docs.aws.amazon.com/iot/latest/developerguide/iot-sdks.htmlOther times IPC resources map to resources in other parts of AWS (e.g. secrets stored in Secrets Manager). To access those, you would typically need IAM credentials. Greengrass can get IAM credentials using the role alias. You would also configure this policy for anything your component accesses using the regular AWS SDK.https://docs.aws.amazon.com/greengrass/v2/developerguide/interact-with-aws-services.htmlAnd finally, you can also connect external client devices to Greengrass. You can configure the Client Devices Auth component in order to define the permissions that client devices have when connecting to the local MQTT broker.https://docs.aws.amazon.com/greengrass/v2/developerguide/connect-client-devices.htmlYou don't need to worry about the service role, for the most part. That gets used by the Greengrass cloud service in a few scenarios when using client devices. You can set it up once (if using client devices) and then forget it exists.CommentShareJoeAtAWSanswered 8 months agoflycast 8 months agoThanks @JoeAtAWS. That is very clear.Share"


Question: How get or set the root password on lightsail lamp mariadb

"I created a new lightsail lamp instance using php 8.  It gave me mariadb.  I think all is set, but I cannot log in as root to mariadb to change the root password or add a user or whatever.  I have been searching and trying things for hours.  How do I get control of this?  I tried changing my my.cnf to have skip-grant-tables, and then I could get in by doing mysql - u root, but it still would not let me change the root password.  it says user not in table.  I tried changing to table mysql and I can list the root user.  If I could find the root password, that would be fine as well as then I could log in with phpmyadmin.  I am trying to upgrade my lightsail instance to the latest version.  I have everything else working, but can't load the database because I can't access it.  Not sure what to try next.  Please advise.  Thanks in advance for any help.FollowComment"

Answer: "0Accepted AnswerI solved this and it was simple.  I am keeping it out here so it may help someone else.All you do is log into your instance using ssh.  In the /home/bitnami folder, there is a file called bitnami_application_password.  The password in there is the mysql password for root.CommentSharerePost-User-6367281answered 5 days ago"


Question: Automatically tag Redshift Snapshots

Is there a way to automatically tag the auto snapshots in Redshift?  I simply want the tags from the cluster applied to each snapshot when it's created.FollowComment

Answer: "0Hello,Thank you for reaching out to us with your concern. I understand that you would like to know a way to automatically tag the auto snapshots in Redshift.Automated snapshots inheriting tags associated with your Redshift cluster.While creating a Manual Snapshot, it will inherit the tags from the Cluster and tags are retained after you restore a snapshot of a Cluster within the same region (note that tags are not retained if you copy a snapshot to another region), the same does not apply to Automated Snapshots.When Automated Snapshots are created, tags are not inherited from the Cluster, and therefore are not retained after you restore a snapshot. Additionally, while you can add tags directly to the automated snapshot via console (CLUSTERS -> Snapshots -> Actions -> Manage tags), it will also fail to retain the tags after you restore the snapshot.That being said, and considering that Automated Snapshots do not inherit nor retain the tags.I have checked internally and confirmed that there is already a Feature Request for Automatic Tagging of Automated RedShift Snapshots.Kindly note that, due to the managed nature of the service, before a formal introduction, features are required to be tested and pre-configured as per the existing ecosystem. Since we have no visibility over the internal development cycles, because of which I unfortunately would not be able to provide you with an ETA on when this feature would be implemented/released. However I would recommend you to refer to and keep an eye on the following links for announcements regarding latest features in Amazon Redshift, as it would be publicly announced as soon as this feature is introduced:[1] AWS What's New - http://aws.amazon.com/new/[2] AWS Blog - https://aws.amazon.com/blogs/?awsf.blog-master-database=category-database%23amazon-redshift[3] AWS Forums - https://forums.aws.amazon.com/forum.jspa?forumID=155Currently available options to apply tags to automated snapshotsAn alternative way to automate this process at your end would be to make use of CLI/API operations. These CLI/API operations can be used as a part of any automated code/script/function (such as a cron job, a Lambda function, or any other suitable/feasible method to automate the process of creating/applying tags) to apply tags to automated snapshots, without having to perform the same manually via the console. The code/functionality of the automated solution would be to apply/create tags for automated snapshots [4].For example, the create-tags CLI command can be run to apply tags to an automated snapshot. The create-tags API requires the ResourceName to be provided, whose ARN format is as follows:arn:aws:redshift:region:account-id:snapshot:cluster-name/snapshot-nameOnce you obtain the name of the snapshot, the above ARN can be formed, post which the ARN can be passed to the create-tags command to apply required tags.I have tested the same at my end and I was able to successfully add a tag to an automated snapshot of my Redshift cluster in the below manner:#> aws redshift create-tags --resource-name arn:aws:redshift:us-east-1:xxxx:snapshot:xxxx/rs:xxxx --tags "Key"="type","Value"="automated"Post running the above, a tag "type=automated" was added to the automated snapshot, which can be verified on the console, as well as by using the describe-tags CLI command:aws redshift describe-tags --resource-name arn:aws:redshift:us-east-1:xxxx:snapshot:xxxx/rs:xxxxOutput:{"TaggedResources": [    {        "Tag": {            "Key": "type",            "Value": "automated"        },        "ResourceName": "arn:aws:redshift:us-east-1:xxxx:snapshot:xxxx/rs:xxxx",        "ResourceType": "snapshot"    }]}I hope the above information is useful to you.Thank you and have a nice day ahead!==== References ====[4] Tagging resources in Amazon Redshift- https://docs.aws.amazon.com/redshift/latest/mgmt/amazon-redshift-tagging.html[5] create-tags - https://docs.aws.amazon.com/cli/latest/reference/redshift/create-tags.html[6] describe-tags - https://docs.aws.amazon.com/cli/latest/reference/redshift/describe-tags.html[7] Manage tags for Redshift resources using CLI/APIoperations- https://docs.aws.amazon.com/redshift/latest/mgmt/rs-mgmt-tagging-cli-api.htmlCommentSharerePost-User-4235331answered 9 months ago"


Question: RDS Postgresql migrate to Aurora Postgresql. Not showing "Aurora read replica" & "Migrate snapshot" options.

"Hi,According to https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Migrating.html#AuroraPostgreSQL.Migrating.RDSPostgreSQL.Import.Console it's possible to migrate PostgreSQL RDS (12.7) to Aurora by adding Aurora Read Replica.But I have no such option for my PostgreSQL RDS.Is it has some problems in this feature?I tried other options "Migrating an RDS for PostgreSQL DB instance using a snapshot", but it also inacitvated button in my dashboard.Is it possible that the feature was announced but isn't available yet?FollowComment"

Answer: "2Accepted AnswerHi,This is an known issue identified by our internal team and investigation is on going.I personally have tested that option to create aurora read replica works for below versions through console.RDS PostgreSQL 12.5RDS PostgreSQL 9.6.21For RDS PostgreSQL 12.7, no option presents from the console.Workaround is to use CLI command:Use below to create a cluster:aws rds create-db-cluster --db-cluster-identifier Aurora-cluster --engine aurora-postgresql --db-subnet-group-name <subnet-group-name-here> --replication-source-identifier <source-RDS-instance-arn> --region us-east-1 --engine-version 12.7Use below to add instances to the cluster via the CLI command:aws rds create-db-instance --db-instance-identifier <instance-identifier> --db-instance-class <instance-class> --engine aurora-postgresql --db-cluster-identifier <db-cluster-identifier> --region us-east-1Hope CLI command can help you workaround the issue.CommentShareSUPPORT ENGINEERKevin_Zanswered a year agoAWS-User-5397853 a year agoI'm experiencing the same problem from RDS console. and would prefer not to have to resort to CLI in future. is there an ETA on this fix?Sharebrainwipe a year agoI'm experiencing the same problem on 13.4 - I've managed to migrate my Test and Staging databases but not the production one. Any idea when this might be fixed?Sharekostyanius a year agoLooks like AWS does not care about this issue and no one is going to fix it. What a shame!Share0Thanks Kevin!It's really helpful!!!CommentShareAWS-User-5482625answered a year ago0I experience same issue with RDS Postgres 11.13CommentShareamudhanpanswered a year ago"


Question: Aurora Serverless v1 scaling or Data-API for v2?

"We jumped on the wagon of Aurora Serverless v1, Postgresql, as the use-case for us with micro-services and many databases was perfect together with AppSync.Only too late did we realize how bad Aurora Serverless v1 works with scaling, as it can't scale when there are open transactions. Also there is a hard limit of 500 connections maximum of the Data-API.This causes a lot of DB outages for us...We were part of the early adopters of Aurora Serverless v2 and tested the scaling which works nicely (it's what v1 should have been)...The lack of the Data-API in v2 surprised us as we can't upgrade because of AppSync.Can you share any details if Data-API will be available on v2, and when, or if you will fix v1's flawed scaling?FollowComment"


Question: How do i increase my wordoc storage

"Hi,  i would like to increase my wordoc storage.   50GB is not enough.FollowComment"

Answer: 0Let me add the pricing link for Workdocshttps://aws.amazon.com/workdocs/pricing/if you want to increase you need to apply your administrator so he can increase your quotaCommentShareEXPERTsdtslmnanswered 6 days ago


Question: "AWS Control Tower failed to set up your landing zone completely: An error occurred while setting up your landing zone. Try again later. If this error persists, contact AWS Support"

"Without raising support ticket , how can i trace the error log and trying to troubleshoot myself. there is errors mentioned on the cloudtrail logs , only seeing landing zone status as failedFollowComment"

Answer: "0There are a few ways you can go about tracing and troubleshooting the error log without raising a support ticket.Check the CloudTrail logs for more detailed information about the error. This will give you insight into what went wrong, and may point you in the direction of a solution.Check the configuration of the landing zone to ensure everything is set up correctly. This includes verifying that all settings are correct, permissions are in place, and any necessary resources are available.Test the landing zone with a small sample of data to see if the issue is reproducible. This will help you to identify any configuration issues that may be causing the failure.Reach out to your cloud provider's support team for assistance. They may be able to provide more information about the error and offer suggestions on how to resolve it.CommentShareDivyam Chauhananswered 4 months ago"


Question: An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

"Just done creating a cluster and connecting to it... Now when I try to list the s3 bucket via: aws s3 ls bucketname,It give me ERROR message like:An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied.I was wondering if someone has the same issue and how I should resolve it. I am a IAM user, not the account manager.FollowCommentSri a year agoplease check this https://repost.aws/questions/QUqJvEqUeDQVqVp_8N0KfUbA/include-s-3-list-objects-v-2-as-action-in-bucket-policyShare"

Answer: "0Hello,The error suggests that your IAM identity (your IAM user here) does not have the permission to List the bucket (s3:ListBucket action) in question.Please refer this Knowledge Article on how to provide this permission to your IAM identity - https://aws.amazon.com/premiumsupport/knowledge-center/s3-access-denied-listobjects-sync/In case your IAM user and S3 bucket belong to 2 different AWS accounts, make sure that in addition to the above, your bucket policy also gives permission to your IAM user to perform ListObjectsV2 operation.ThanksCommentShareSUPPORT ENGINEERRuhisar_Tanswered a year ago0If you have CloudTrails enabled for that user, you can use IAM Access Analyzer under that user to find out what policies you need to add.  Check out this documentation.  https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-generation.htmlCommentSharejschwar313answered a year ago"


Question: Invalid template property or properties error

"I get "Invalid template property or properties [TestLambda]" from the following template.  I've validated the json with an online json validator.  I've tried removing the properties one by one, but still get the error.  The error message is useless in diagnosing the problem.Can anyone see what the problem is?Thanks.{"Parameters": {"DeploymentBucket": {"Type": "String","Description": "S3 bucket name where built artifacts are deployed"},"ProjectVersion": {"Type": "String","Description": "Project Version"},"DeploymentTime": {"Type": "String","Description": "It is a timestamp value which shows the deployment time. Used to rotate sources."},"DomainName": {"Type": "String","Description": "Domain Name to serve the application"},"CloudSearchDomain": {"Type": "String","Description": "Endpoint Name for CloudSearch domain"}},"Resources": {"LambdaExecutionRole": {"Type": "AWS::IAM::Role","Properties": {"Path": "/","AssumeRolePolicyDocument": {"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"Service": ["lambda.amazonaws.com","apigateway.amazonaws.com"]},"Action": ["sts:AssumeRole"]}]},"ManagedPolicyArns": ["arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"]}},"LambdaCustomPolicy": {"Type": "AWS::IAM::Policy","Properties": {"PolicyName": "LambdaCustomPolicy","PolicyDocument": {"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["s3:ListBuckets"],"Resource": "*"}]},"Roles": [{"Ref": "LambdaExecutionRole"}]}}},"TestLambda": {"Type": "AWS::Lambda::Function","Properties": {"Handler": "com.serverlessbook.lambda.test.Handler","Runtime": "java8","Timeout": "300","MemorySize": "1024","Description": "Test lambda","Role": {"Fn::GetAtt": ["LambdaExecutionRole","Arn"]},"Code": {"S3Bucket": {"Ref": "DeploymentBucket"},"S3Key": {"Fn::Sub": "artifacts/lambda-test/${ProjectVersion}/${DeploymentTime}.jar"}}}}}FollowComment"

Answer: "0I passed your JSON through a JSON pretty print ( can you please post it to gist.github.com so it's easier to read? ) and it looks like your lambda resource is outside of the Resources block.Edited by: cwprogram on Jul 22, 2017 5:21 PMCommentSharecwprogramanswered 6 years ago0You're correct about the Lambda being outside of the resources block.  CloudFormation's error message should indicate that.I also had to remove two parameters which were not used (DomainName and CloudSearchDomain).Now I get this error message:Status of stack serverlessbook is UPDATE_ROLLBACK_COMPLETE.  It seems to be failed.Where do I look to see what caused the rollback?CommentShareDeanInCOanswered 6 years ago0In the CloudFormation console go to the listing of Stacks. From there either click on the name of the stack in question in the listing, or select it (by clicking on the check box) and then go to "Events". This will show what Resource failed and indicate why it failed.CommentSharecwprogramanswered 6 years ago0{"Parameters": {"DeploymentBucket": {"Type": "String","Description": "S3 bucket name where built artifacts are deployed"},"ProjectVersion": {"Type": "String","Description": "Project Version"},"DeploymentTime": {"Type": "String","Description": "It is a timestamp value which shows the deployment time. Used to rotate sources."},"DomainName": {"Type": "String","Description": "Domain Name to serve the application"},"CloudSearchDomain": {"Type": "String","Description": "Endpoint Name for CloudSearch domain"}},"Resources": {"LambdaExecutionRole": {"Type": "AWS::IAM::Role","Properties": {"Path": "/","AssumeRolePolicyDocument": {"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"Service": ["lambda.amazonaws.com","apigateway.amazonaws.com"]},"Action": ["sts:AssumeRole"]}]},"ManagedPolicyArns": ["arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"]}},"LambdaCustomPolicy": {"Type": "AWS::IAM::Policy","Properties": {"PolicyName": "LambdaCustomPolicy","PolicyDocument": {"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": ["s3:ListBuckets"],"Resource": "*"}]},"Roles": [{"Ref": "LambdaExecutionRole"}]}},"TestLambda": {"Type": "AWS::Lambda::Function","Properties": {"Handler": "com.serverlessbook.lambda.test.Handler","Runtime": "java8","Timeout": "300","MemorySize": "1024","Description": "Test lambda","Role": {"Fn::GetAtt": ["LambdaExecutionRole","Arn"]},"Code": {"S3Bucket": {"Ref": "DeploymentBucket"},"S3Key": {"Fn::Sub": "artifacts/lambda-test/${ProjectVersion}/${DeploymentTime}.jar"}}}}}}CommentShareawsram2452answered 4 years ago0fixed template. please accept the answerCommentShareawsram2452answered 4 years ago"


Question: Edit App Production Branch URL

"Hi,Is there a way to update the app production branch url? I'm using subdomain for the entire app so my production branch would be {appName/subdomain}.domain.com rather than {branch}.domain.com I don't see any serious issues with this since no new record was created on Route 53 for the default {branch}.domain.com but just curious if there's a way to update that.Thanks!FollowComment"

Answer: 0Accepted AnswerThanks for reply. This is only a UI issue. The {branch}.domain.com won't work. What's really connected to your branch is your custom settings in the domain management.CommentShareAWS-User-0568200answered 4 years ago


Question: deploy new cdk Aurora Cluster

"Hi team,I have an aurora DB cluster already created via CDK,for compliance reasons, now I changed my CDK code to  enable encryption on my Aurora DBwhen deploying the CDK code, a new cluster was created (with encryption option enable this time) but I had this error :Myst1Stack | 2/9 | 10:15:20 a.m. | UPDATE_ROLLBACK_IN_P | AWS::CloudFormation::Stack | Myst1Stack Export Myst1Stack:ExportsOutputFnGetAttdb123D8BCEndpointAddressABC1244 cannot be updated as it is in use by Myst2Stack, Myst3Stack and Myst4Stackany idea how can I resolve the dependencies issues to be able to deploy my new CDK codeThank youFollowComment"

Answer: "0Accepted Answerfollowing those steps :a)dissociate st1 with dependents using native cfnb)deploy the modified stack : st1c)redeploy st2, st3, st4 to restore links between stacksexamples here :https://amchelle.medium.com/how-to-fix-aws-cdk-error-export-export-name-cannot-be-updated-as-it-is-in-use-by-stack-name-c106b379d359https://aws.amazon.com/premiumsupport/knowledge-center/cloudformation-stack-export-name-error/#:~:text=To%20resolve%20this%20error%2C%20complete,stack%20using%20the%20modified%20templateCommentShareJessanswered a year ago0This error means that you are exporting a value, and as part of the stack update, that value is being changed. Unfortunately, this cannot be done when those exported values are being used in other stacks, as there is no mechanism for cascading this change down to the other stacks that rely on the new value.To get around it, you will need to update the other stacks to use a static value before you can update Myst1Stack. After doing this, you can update these stacks to use the export again.This documentation [1] describes a way to track this down via native CloudFormation. If these other stacks are also CDK, you can update these references in their CDK code, or you could modify the values temporarily in the CFN template to allow this update to go through, and then simply re-deploy the previous version of these stacks from CDK, as the needed metadata for CDK to link to your project will still be present.[1] https://aws.amazon.com/premiumsupport/knowledge-center/cloudformation-stack-export-name-error/CommentShareSUPPORT ENGINEERWayne_Ganswered a year ago"


Question: How to create EKS cluster with dedicated host node group

I have created a launch template that has the tenancy: Dedicated with the respective host ID. I am using the launch template to create a node group for an EKS cluster but I see an internal error: " EKS couldn't process your request". I can roll up an ec2 instance using the launch template.How can I create a node group using a Dedicated host?FollowComment

Answer: "1Based on the document [1], we can know that only self-managed node group can deploy the container on EC2 dedicated hosts . Which mean that customer need to manually create launch template, auto scaling group, and register it to the EKS cluster. The creation process should be same as general EC2 auto scaling creation.For now, EKS managed node group only supported on-demand and spot.Here is the point need to be noted:a) According to this document [2], seems like auto scaling group only supported dedicated host resource group.b) When you complete the dedicate host creation [3], please make sure you have purchased dedicated host reservations [4].c) Make sure you enable the "Auto-placement" on dedicated host [5].d) Please make sure you have tagged the instance "kubernetes.io/cluster/<cluster-name>: owend".In the launch template configuration, you just need to configure the instance should run on dedicate host. Due to we have enabled the auto-placement, it would launch on any Dedicated Host that has auto-placement enabled and that matches its instance type.[1] Amazon EKS nodes - https://docs.aws.amazon.com/eks/latest/userguide/eks-compute.html[2] Dedicated Hosts - Dedicated Hosts restrictions - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-hosts-overview.html#dedicated-hosts-limitations[3] Work with Dedicated Hosts - Allocate Dedicated Hosts - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/how-dedicated-hosts-work.html#dedicated-hosts-allocating[4] Work with Dedicated Hosts - Purchase Dedicated Host Reservations - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/how-dedicated-hosts-work.html#purchasing-dedicated-host-reservations[5] Work with Dedicated Hosts - Auto-placement - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/how-dedicated-hosts-work.html#dedicated-hosts-auto-placementBest Regards,JayCommentShareJay Danswered a year agoDolis a year agoI was referring to this doc to create a self-managed node group that specifies creating a node group using a cloud formation template. I am editing the default cloud formation "NodeLaunchTemplate" with below:NodeLaunchTemplate: Type: "AWS::EC2::LaunchTemplate" Properties: LaunchTemplateData: BlockDeviceMappings: - DeviceName: /dev/xvda Ebs: DeleteOnTermination: true VolumeSize: !Ref NodeVolumeSize VolumeType: gp2 - Placement: Tenancy: dedicated HostId: h-0c37fc21d3e2cb2*But this doesn't work and gives me error "Property validation failure: [Encountered unsupported properties in {/LaunchTemplateData/BlockDeviceMappings/1}: [Placement]]"What is the right cloud formation template for dedicated host, if not how can I create a self-managed node group without a cloud formation template?Would be great if you can help me with any doc or the steps.Share0Accepted AnswerEKS does not support managed node groups for a dedicated host, we have to implement this using self-managed node groups. The way you can do is already documented in the self-managed section in the EKS docs.(https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html)  You will have to add the "Placement" parameters in the properties section (refer below) of the cloudformation template and that it should work:Properties:  LaunchTemplateData:    BlockDeviceMappings:      - DeviceName: /dev/xvda        Ebs:          DeleteOnTermination: true          VolumeSize: !Ref NodeVolumeSize          VolumeType: gp2    Placement:      Tenancy: hostThanks!CommentShareDolisanswered a year ago"


Question: Is it possible to install Drupal 7 on Lightsail instead of 9.4.9-2?

"Is it possible to install Drupal 7 on Lightsail instead of 9.4.9-2? I don't see the option available to do that.If yes, how to do that?FollowComment"

Answer: "0Drupal 7 end of life, set for November 2023. But still if you want you can install it manually on a Light Sail instance.LuangInstall the LAMP Stack : https://www.drupal.org/docs/develop/local-server-setup/linux-development-environments/installing-php-mysql-and-apache-underThen follow from the step 2 : https://www.drupal.org/docs/7/installwhile installing if you get any errors let me knowCommentShareawsfanboyanswered 4 months agorePost-User-8853678 4 months agoOk, but then I would create the machine using the version 9.4.9-2 + OS? Or I just get the machine with OS and then do the manual installation? Do you have any recommendation? Any suggestion regarding which OS I should pick in case of the second option? ThanksShare"


Question: IAM Role Mapping on EKS

"I am working on IaC EKS using terraform.https://www.ahead.com/resources/automate-iam-role-mapping-on-amazon-eksI receive below error.Error: creating IAM Role (eks_admin): MalformedPolicyDocument: Invalid principal in policy: "AWS":"arn:aws:iam::xxxxxxxxxxx:user/eks-test-usr"status code: 400resource "aws_iam_role" "eks_admin" {  name = "eks_admin"  assume_role_policy = jsonencode({    Version = "2012-10-17"    Statement = [      {        Action = "sts:AssumeRole"        Effect = "Allow"        Sid    = ""        Principal: { "AWS" : "${var.assume_role}" }      },    ]  })  inline_policy {    name = "eks_admin_policy"    policy = jsonencode({      Version = "2012-10-17"      Statement = [        {          Action   = ["eks:DescribeCluster"]          Effect   = "Allow"          Resource = "*"        },      ]    })  }}I pass the variable as assum_role=["eks-test-dev","eks-test-admin"]FollowComment"

Answer: "2Hello rePost-User-9219791,You are facing this issue because your terraform variable assume_role is a list of role names.The Principal property of the IAM policy only allows role ARNs as valid principals. Therefore, pass the list of role ARNs instead of role names as shown below.assume_role=["arn:aws:iam::<account_id>:role/eks-test-dev","arn:aws:iam::<account_id>:role/eks-test-admin"]Also make sure that the above roles exist in your AWS account before creating the IAM role resource using terraform.I hope this helps!CommentShareSUPPORT ENGINEERVenkat Penmetsaanswered 2 months agorePost-User-9219791 2 months agoThanks. I did the same, but the list I passed didn't exist in my AWS account.Share"


Question: Duplicate emails and spam

Good night.I would like a help to identify 2 problems in the workmail please.The first is that incoming emails arrive in the duplicate inbox.How can I solve?The second is that some recipients complain that the emails I send arrive as spam to them.How can I fix this?I appreciate the help of the community.Thank you!FollowComment

Answer: "0Hi,I'm sorry to hear you're experiencing problems with duplicate emails and false positives on your outgoing mail. I checked your account and both can easily be resolved.For the duplicate emails, it seems you have 2 Workmail actions configured in your SES Inbound rules. You can remove the one starting with "new-" as this one is for only 1 email address not the entire organization.For the false positives for outgoing mail, your SPF record is still configured for Google. This means the SPF record states that WorkMail is not allowed to send from your domain and recipient use that to mark your mail as spam. Check your domain in the Domains page in the WorkMail console for the correct domain values.After correcting these problems, you should no longer receive duplicate email and your email is no longer seen as spam.Kind regards,RobinCommentShareMODERATORrobinkawsanswered 3 years ago0Perfect Robink!Thanks for your help!!!Edited by: tfurlan on Oct 14, 2020 5:07 PMCommentSharetfurlananswered 3 years ago"


Question: variableMap in AppSync Resolvers no longer accepts array values

"Since yesterday from 03:00AM to 18:20PM (UTC+00:00) approximately, we had our app down because of a non announced breaking change in AppSync.It turns out that, now, the variableMap JSON of the "Before Mapping Template" no longer accepts to set a property with an array value.We had to rewrite the queries because we couldn't just do it like follows:#set($sql = 'SELECT item_idFROM demo_tableWHERE item_id IN (:ITEM_IDS)'){    "version": "2018-05-29",    "statements": [        "$util.escapeJavaScript($sql)"    ],    "variableMap": {    ":ITEM_IDS": $ctx.args.param_item_ids,    }}Instead, we had to figure out how to achieve the same result with an alternative approach, and we came across with the following one based on string searching:#set($sql = 'SELECT item_idFROM demo_tableWHERE INSTR(:ITEM_IDS, concat("#", item_id, "#")) > 0')[...]#set($item_ids = "")#foreach($item_id in $param_item_ids)#set($item_ids = $item_ids + "#" + $item_id + "#")#end[...]{    "version": "2018-05-29",    "statements": [        "$util.escapeJavaScript($sql)"    ],    "variableMap": {    ":ITEM_IDS": "$item_ids",    }}Okay, it works too. But as you may guess, this is a very simplified query example. The production query is far more complex, and it not only handles one single array param value, but many.So you can imagine the extra work that it involves to write all this boilerplate just to do a fairy simple WHERE ... IN (...).Apart from the over complexity to write common queries, we are very concerned about another big issue: performance.With this approach, the internal query analyzer cannot do a good job optimizing the queries since it no longer handles indexed item IDs.Any clarification about this breaking change would be much appreciated.Best regards,IgnasiFollowComment"

Answer: "0SOLVED: We have noticed that, luckily, you have reverted that change, because the WHERE ... IN (...) clause can be used again.CommentShareignasianswered 3 months ago0BROKEN AGAIN: Really? After two weeks, ARRAYS are no longer accepted again. We get this error message:{    "data": {        "data": null    },    "errors": [        {            "path": [                "data"            ],            "data": null,            "errorType": "MappingTemplate",            "errorInfo": null,            "locations": [                {                    "line": 2,                    "column": 3,                    "sourceName": null                }            ],            "message": "Variables-map values must be either of type String, Boolean, Double, Integer, Long, or null. (you provided ARRAY)"        }    ]}CommentSharerePost-User-4952892answered 2 months ago"


Question: Shouldn't the AWSReadOnlyAccess permission group allow access to query Athena tables

"In an enterprise account, and wanted to give someone access to query the Cloudtrail logs that are in the Log Archive account Control Tower created. But when I go in with the permission set AWSReadOnlyAccess I get errors bringing up Athena and can't see the tables that were created in there. It all seems like it should be read-only stuff; is that just a miss on AWS's part? Not very useful if the first thing I tried that set of permissions with doesn't work.User: arn:aws:sts::....:assumed-role/AWSReservedSSO_AWSReadOnlyAccess_.../... is not authorized to perform: athena:GetQueryExecution on resource: arn:aws:athena:us-east-1:...:workgroup/primary because no identity-based policy allows the athena:GetQueryExecution action This query ran against the "" database, unless qualified by the query.FollowComment"

Answer: "1The AWSSSOReadOnly policy is about having read only access to the AWS SSO service and its resources, not AWS in general.What you probably want is to attach the ReadOnlyAccess AWS managed policy to your permission set, as it has permissions like athena:Batch*, athena:Get*, and athena:List*.CommentSharerowanuanswered a year ago"


Question: zone to registered domain mapping

"Hi. I have domain registered with AWS and lets say example.comThere is a NS and SOA record, however a dig or nslookup isn't currently resolving and think related tohttps://repost.aws/questions/QULvn-o4npQQOV7y_iUCFNFQ/ns-and-soa-records-in-my-host-zone-but-cant-find-them-when-i-use-dig (and now updated for example.com but waiting for it to propagate)So what about having a sub-domain? i.e . I require test.example.comI have this under the hosted zones, but how do I now link this to registered domains or rather what exactly do I need to do to create sub-domain?BTW, in both cased, AWS hosts for the domains example.com and test.example.com are external to AWS and trying to create a SSL that can be used  - however in first instance need example.com and test.example.com to at least resolve.ThanksMarkFollowComment"

Answer: 0These QA list might help youhttps://repost.aws/search/questions?globalSearch=cloudfront+apex+sub-domainCommentSharerePost-User-5208427answered 2 months ago


Question: AWS Data Transfer

How can I investigate how does AWS Data Transfer uses (or deactivate this service to avoid accidental billings)FollowComment

Answer: "0Hi,There are two options I recommend:If you can access to AWS Cost Explorer: Using AWS Cost Explorer to analyze data transfer costs ( https://aws.amazon.com/blogs/mt/using-aws-cost-explorer-to-analyze-data-transfer-costs/ )Another option: Using CUDOS Dashboard to better visualise data transfer charges ( https://wellarchitectedlabs.com/cost/200_labs/200_cloud_intelligence/#cudos-dashboard ).Thank youCommentShareAWS-User-9882077answered 23 days ago0Here is an example of CUDOS Dashboard: https://d1s0yx3p3y3rah.cloudfront.net/anonymous-embed?dashboard=cudos  (you may want to select Data Transfer) Menu at the top.CommentShareAWS-User-9882077answered 23 days ago0You cannot deactive Data Transfer if you are using other services like EC2 or S3. Charges for Data Transfer is essentially charges for traffic that is being sent by your resources, for example, outside to the Internet, or to other AWS Regions, or between availability zones within the same AWS region. Check the links to resources provided in other answers, - you can use for example AWS Cost Explorer to investigate which services are generating data transfer charges: https://aws.amazon.com/blogs/mt/using-aws-cost-explorer-to-analyze-data-transfer-costs/Also, check out this video training we've done a while ago that talks about different types of data transfer charges and how to investigate them using billing monitoring tools: https://www.youtube.com/watch?v=UjliYz25_qoIf you want to avoid data transfer charges, the best option is to watch out who is sending traffic to and from your AWS resources, and especially be careful with access and permissions. If your resources should not be accessing internet, make sure to set up the relevant security permissions; that way you would not see major traffic charges (unless, for example, you need your EC2 instances to ocasionally connect to the internet for patching; but for these purposes you could just stay within the Free Tier limits of data transfer charges).CommentShareEXPERTNataliya_Ganswered 22 days ago"


Question: Can we allow getObject with bucket policy using  "Effect": "Deny" and condition


Question: How to append timestamp to s3 bucket name in suffix using cloudformation template?

"I am using AWS cloud formation template for creating resources in my AWS account. Now, in order to make the s3 bucket name unique, I want to add the current timestamp to the suffix of s3 bucket name so that it'll be unique everytime. Is there any way to carry this out using cloud formation template or lambda functions? If there is a way, please let me know. Thanks in advance.FollowComment"

Answer: "1One way to do it is to write your own CloudFormation Macro or use an existing one.  Have a look at the example Macros at https://github.com/aws-cloudformation/aws-cloudformation-macros to see what's possible.  The PyPlate macro there may suit your needs without you having to write a new Macro.Another option is the write a Custom Resource.  If you do, I strongly recommend making use of something like crhelper (https://github.com/aws-cloudformation/custom-resource-helper) - it makes it so much easier.CommentShareEXPERTskinsmananswered a year ago1I would not recommend creating a custom resource for this at all. Indeed a macro is more appropriate for what you are trying to do.But I would still recommend to stick to what CloudFormation "native" has to offer in this particular use-case for the bucket name: have a parameter for the bucket name. Personally though, I much prefer to to add region and account number with the native functions. The only parameter you need is a prefix (or suffix) to the bucket name.Hope this helps :)CommentShareJohnPrestonanswered a year ago"


Question: Cloudfront returning 403

"Dear Support and Community,I use the following code to get a cloudfront distributed audiostream on my website.Without cookie authorization everything works fine. When I use the code on my wordpress website the cookies get set as expected but cloudfront still rejects access with a 403 error. Do you see any mistakes I could have made?BR Iggy<?php/** * Plugin Name: CloudFront Auth Plugin 0.5 * Description: Ein Plugin zur Implementierung der CloudFront-Cookie-Authentifizierung. * Version: 0.5 * Author: us * License: GPL2 */function createSignedCookie($streamHostUrl, $resourceKey, $timeout){    error_log('function createSignedCookie gestartet');    $keyPairId = "APKA5**********HZVB"; // Key Pair    $expires = time() + $timeout; // Expire Time    $url = $streamHostUrl . '/' . $resourceKey; // Service URL -> The path for that the cookies shall be valid    $ip=$_SERVER["REMOTE_ADDR"] . "\/24"; // IP    $json = '{"Statement":[{"Resource":"'.$url.'","Condition":{"DateLessThan":{"AWS:EpochTime":'.$expires.'}}}]}';        $private_key_path = __DIR__ . '/private_key.pem';    $fp = fopen($private_key_path, 'r');    if (!$fp) {        return;    }    $priv_key=fread($fp, 8192);    fclose($fp);        $key = openssl_get_privatekey($priv_key);    if(!$key){        return;    }    if(!openssl_sign($json, $signed_policy, $key, OPENSSL_ALGO_SHA1)){        error_log('Failed to sign policy: ' . openssl_error_string());        return;    }        $base64_signed_policy = base64_encode($signed_policy);        $policy = strtr(base64_encode($json), '+=/', '-_~'); //Canned Policy        $signature = str_replace(array('+','=','/'), array('-','_','~'), $base64_signed_policy);        $signedCookie = array(        "CloudFront-Key-Pair-Id" => $keyPairId,        "CloudFront-Policy" => $policy,        "CloudFront-Signature" => $signature    );    return $signedCookie;}                                        function TriggerSignedCookies(){    $signedCookieCustomPolicy = createSignedCookie('cookietest.ourwebsite.com', 'music.mp3', 300);    foreach ($signedCookieCustomPolicy as $name => $value) {        setcookie($name, $value, 0, "/", "ourwebsite.com", true, true);    }} function SetCloudFrontCookies() {    global $post;                                            if (is_a($post, 'WP_Post') && has_shortcode($post->post_content, 'SetCookies')) {        TriggerSignedCookies();    }}function ShortcodeHandler() {    // Gibt einen leeren String zurück, um zu verhindern, dass "1" auf der Website angezeigt wird.    return '';}function ShortcodeInit() {    add_shortcode('SetCookies', 'ShortcodeHandler');}add_action('init', 'ShortcodeInit', 0);add_action('send_headers', 'SetCloudFrontCookies', 0);?>FollowComment"

Answer: "4Make sure the CloudFront distribution is configured to require signed cookies:Go to your CloudFront distribution settings in the AWS Management Console.Under the "Behaviors" tab, make sure the "Restrict Viewer Access (Use Signed URLs or Signed Cookies)" is set to "Yes."Confirm that the "Trusted Key Groups" or "Trusted Signers" are set correctly with the key pair you're using.Review the CloudFront behavior settings:Make sure the "Forward Cookies" setting is set to "All"3.Modify the cookie path and domain:Update the cookie path and domain in the setcookie() function. If your CloudFront distribution is on a subdomain, you should set the cookie path to the root ("/") and the domain to the subdomain (e.g., "cookietest.ourwebsite.com").4.Verify that the cookies are being sent with the request:Use browser developer tools to check if the cookies (CloudFront-Key-Pair-Id, CloudFront-Policy, and CloudFront-Signature) are being sent with the request to CloudFront.Check the CloudFront access logs:Enable access logging for your CloudFront distribution.Check the logs in the specified S3 bucket for more information about the 403 error. This might give you a better idea of what's causing the issue.CommentShareEXPERTsdtslmnanswered 2 months agoTheIggy 2 months agoThank you for your reply.Yes, the distribution is configured to use signed cookies. The cookies are being sent. I can see them in the Cloudfront standard logs. Do you mean the cache policy shall forward cookies to the origin?I don't think that my origin (an externally hosted icecast server) could handle the Cloudfront cookies.My server logs don't show any login attempts.Share"


Question: Point in Time Recovery on Deleted Tables

"I understand it's possible to restore deleted table from standard backups, but I'm wondering what happens to a Tables Point-in-Time recovery settings once it's been deleted. I can't seem to find any information about it in the documentation.If a table with "Point-in-Time Recovery" enabled is deleted from DynamoDB, is it possible to run a Point-in-Time restore for that table, and if so how?FollowComment"

Answer: "0Accepted Answerscoll wrote:I understand it's possible to restore deleted table from standard backups, but I'm wondering what happens to a Tables Point-in-Time recovery settings once it's been deleted. I can't seem to find any information about it in the documentation.If a table with "Point-in-Time Recovery" enabled is deleted from DynamoDB, is it possible to run a Point-in-Time restore for that table, and if so how?On-demand backups remain accessible even after you delete the source table. When you delete a table that has PITR enabled, the system stops tracking changes. If you need to recover a table that you deleted, you need to contact AWS Support to restore that table from a PITR backup within the 35-day recovery window.-JeffCommentShareAWS-User-3100104answered 5 years ago0JeffW@AWS wrote:scoll wrote:I understand it's possible to restore deleted table from standard backups, but I'm wondering what happens to a Tables Point-in-Time recovery settings once it's been deleted. I can't seem to find any information about it in the documentation.If a table with "Point-in-Time Recovery" enabled is deleted from DynamoDB, is it possible to run a Point-in-Time restore for that table, and if so how?On-demand backups remain accessible even after you delete the source table. When you delete a table that has PITR enabled, the system stops tracking changes. If you need to recover a table that you deleted, you need to contact AWS Support to restore that table from a PITR backup within the 35-day recovery window.-JeffYou can now restore a PITR-enabled table that was deleted from the DynamoDB console.https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/pointintimerecovery_beforeyoubegin.htmlCommentShareAWS-User-3100104answered 5 years ago0I have few question on DynamoDB PITR backups.where DynamoDB table PITR backups will store. s3 or different location/service?What will happen to DynamoDB table backups, when i delete DynamoDB, which has PITR enabled. are we able to restore data to any point of time(35 days) or particular time( i mean as part of DynamoDB table delete, final backup will be created under Backup tab).Are we able to rename existing table.CommentSharepratheeshanswered 3 years ago0HelloPlease find the answers to your questions in-linewhere DynamoDB table PITR backups will store. s3 or different location/service?DynamoDB backups are managed service and hence these backups are not stored in customer's S3 , but are stored in internal accountsWhat will happen to DynamoDB table backups, when i delete DynamoDB, which has PITR enabled. are we able to restore data to any point of time(35 days) or particular time( i mean as part of DynamoDB table delete, final backup will be created under Backup tab).All ondemand backups will continue to exist after you delete the table. A new backup will be created on deletion if PITR is enabled.Using the PITR backup , the table will get restored to the Latest restore date (when the table was deleted)Are we able to rename existing table.Currently there is no feature to rename an existing table.ThanksCommentShareAWS-User-1961611answered 3 years ago"


Question: AWS API Gateway with Amazon Cognito User Pools as authorizer

"A customer is interested in using Amazon Cognito User Pools instead of Lambda functions as authorizers for AWS API Gateway.They are trying to figure out if this solution would be ok for production workloads, also focusing on the performance overhead introduced by Cognito. In the past they used to use a Lua backend with HA Proxy and they experienced great performance (overhead in the order of microseconds), so now they are wondering if Cognito can offer good performance as well, maybe adopting some kind of optimizations (caching?). Are there any best practices about that? I don't see any reference to caching in the related documentation webpage.Thanks a lot.FollowComment"

Answer: "0Accepted AnswerCognito is used for Authentication, so it is only used once at the beginning of the session. Once the client gets a token, it uses the same token in all API calls and API Gateway knows how to interpret that token.There are no caching controls for Cognito authorizers, but it may well be that API Gateway implements one. The best would be to run a test and find out if the latency is too high.If latency is an issue for the customer, I recommend using the HTTP API which is 60% less latency compared to the REST API (and also costs 70% less).CommentShareEXPERTUrianswered 2 years ago"


Question: strapi headless cms build error

I was deploying Strapi to AWS and when I write the command to build npm it shows an error of cannot find module : metadata.jsdeployFollowComment


Question: Can't delete workspace

"I have a workspace that I need to delete but all options on the Actions menu are greyed out. I also can not view details of the workspace. If it helps, this is my only workspace so if there is an option to delete all workspaces, that would work to.FollowComment"

Answer: "0Hi,You can follow the steps outlined here on how to remove a WorkSpaces.Since the options are "greyed out" the account you are using to logon to the AWS Web Console does not have the proper IAM permission to remove the WorkSpaces. Check for the IAM policy attached to your AWS User/Role for the account.CommentShareEXPERTDzung_Nanswered a year ago0Can you try with CLI and let me know if you have any issues aws workspaces terminate-workspaces --terminate-workspace-requests **wsb-YourworkspaceID**Note: Deleting a WorkSpace is a permanent action and cannot be undone. The WorkSpace user's data does not persist and is destroyed. For help with backing up user data, contact AWS Support.CommentShareGKanswered a year ago"


Question: How does textract determine when to segment text vertically or horizontally?

"How does textract determine when to segment text vertically or horizontally? Is there a way to help textract do this?For example, this onehttps://gyazo.com/358819c526664c00922c6d231ea38fe5vs this onehttps://gyazo.com/0279b6e040a91392e2ccad1f6379ae31FollowComment"

Answer: "0As of the moment, I am unaware of this parameter. However if you are mostly expecting horizontal text, you might want to test the image above to AWS Rekognition text detection instead https://docs.aws.amazon.com/rekognition/latest/dg/text-detection.htmlCommentShareYoungCTO_quibskianswered a year ago0As of now, Textract does not support vertical text alignment. Please refer to : https://docs.aws.amazon.com/textract/latest/dg/limits.html for more information. The Textract algorithm will perform better on sparser text use cases so we recommend padding the image to improve performance.CommentShareAWS-User-5884210answered a year ago"


Question: App Runner service cannot access Internet when added to a VPC

"I've set up an App Runner service, which works fine. Currently for networking it's configured as public access, but I'd like to change this to a VPC so that I can connect the service to an RDS instance without having to open the database up to the world.When I change the networking config to use my default security group, the service is unable to access the Internet. Cloning a git repo from Bitbucket brings up the error:ssh: Could not resolve hostname bitbucket.org: Try again... and trying to run npm install brings up:npm ERR! network request to https://registry.npmjs.org/gulp failed, reason: connect ETIMEDOUT 104.16.24.35:443My security group has an outgoing rule allowing all traffic out to any destination. My RDS instance is in the same VPC/security group and I'm able to connect to this without issue (currently I've opened up port 3306 to the world). Everything else I've read from a bunch of Googling seems fine: route tables, internet gateways, firewall rules, etc.Any help would be much appreciated!FollowComment"

Answer: "2After a lot of trial and error i have finally found the solution.You should first make sure that you select a public subnet when creating the VPC connectorThen, when the app runner service is running follow the next steps:Go to the network interfaces section, inside VPC module, and you will find one interface with a description starting to Fargate ENI... that belongs to the public subnet you choose when creating the app runner service. That's the network interface of your app runner service. Note down the id of that network interface, eni-...Now go to elastic ip, in the VPC module aswell, and allocate a new elastic ip address.Then, select the new elastic ip and, under the actions button, select associate elastic ip. There, choose network interface and select the network interface id of the step 1.After that, deploy the app runner service again and you should have internet connectivity.CommentShareJavier Morales de VEraanswered a year agocrucis a year agoThank you!SharerePost-User-1140032 8 months agoThank you!SharerePost-User-7379986 8 months agoYou deserve a medal! Thank you!Sharedhaval 8 months agoENI with static IP enables the public traffic, although it defeats the purpose of having other settings in place.Sharedhaval 8 months agoLooking at the VPC connector release notes, it is explained that the egress will be by default disabled and NAT has to be there.https://aws.amazon.com/blogs/aws/new-for-app-runner-vpc-support/When connected to a VPC, all outbound traffic from your AppRunner service will be routed based on the VPC routing rules. Services will not have access to the public internet (including AWS APIs) unless allowed by a route to a NAT Gateway. You can also set up VPC endpoints to connect to AWS APIs such as Amazon Simple Storage Service (Amazon S3) and Amazon DynamoDB to avoid NAT traffic.Share0I ran into the same issue and have used the following to sort it out -https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/CommentShareAWS-User-3199583answered a year ago"


Question: Deploy Spring MVC web application to Lambda

"Hi everyone,I would like to deploy my existed Spring MVC web application (Using external Tomcat) to LambdaI tried to use SpringLambdaContainerHandler and org.apache.tomcat.embed, create a Application.java file to start my project, it's working at my local, but when i deplyed to lambda, invoke the function, it's show the error 404Can you hlep me with this, thanks in advance !My Application.javaMy LambdaHanlder.javaFollowComment"

Answer: "0Hi,When looking at code, the main application seems the one that may cause the issue.One option is  to leverage springboot as for instance here: https://github.com/tyler2cr/AWS-Lambda-with-Spring-MVC.Hope it helps ;)CommentShareEXPERTalatechanswered 13 days agokha 13 days agoThanks for your reply, but I must to use Spring MVC, NOT spring boot. Is there any idea ?Share"


Question: INVALID_CAST_ARGUMENT: Value cannot be cast to date: None

"I have a string type for date and in that column, it has the word 'None'My query for casting the date is below - getting only the Month and Year on it,date_format(cast(c.enddate as date), '%M') as "Month",date_format(cast(c.enddate as date), '%Y') as "Year"ERROR promptedINVALID_CAST_ARGUMENT: Value cannot be cast to date: None-Can somebody help me with this problem, so that I can still get the Month and Year only?Thank you in advance!FollowComment"

Answer: "1Hi,the issue is that you are trying to cast the word ‘None’ to a date, which of course will throw an error.You should add a clause which exclude this value, like where enddate != (is not) ‘None’ or similar, not knowing the context of the query (database, sql, or something else).Hope it helps and if it does I would appreciate answer to be accepted so that community can benefit for clarity, thanks ;)CommentShareEXPERTalatechanswered 2 months agoEXPERTiwasareviewed 2 months ago0You can use a CASE statement to handle the 'None' values before casting the date. In this example, I'll replace 'None' with a NULL value, then proceed with your original query.date_format(    cast(        CASE             WHEN c.enddate = 'None' THEN NULL             ELSE c.enddate         END as date    ),     '%M') as "Month", date_format(    cast(        CASE             WHEN c.enddate = 'None' THEN NULL             ELSE c.enddate         END as date    ),     '%Y') as "Year"This query first checks if c.enddate is 'None', and if so, it replaces it with a NULL value. Then it proceeds with the original cast and date_format functions to extract the Month and Year.CommentShareEXPERTsdtslmnanswered 2 months agoEXPERTiwasareviewed 2 months ago"